People whose data ZenPatient, Inc. says was accessed or copied between December 5, 2025 and February 12, 2026 may be covered by proposed class actions alleging the telemedicine software company failed to protect their health and personal information. No class has been certified and there is nothing to file yet.
Allegations Only · No Settlement Yet
This article describes class action complaints. The statements below are unproven allegations. ZenPatient, Inc. has not admitted wrongdoing and has not been found liable, there is no certified class, and there is nothing to claim at this time. This page is informational. It is not legal advice.
What the ZenPatient Lawsuits Are About
ZenPatient, Inc. is a company based in Playa Del Rey, California, that the first complaint against it describes as a provider of software for telemedicine, patient communication, care workflows and prescription management. In a notice filed with the California Attorney General, ZenPatient says an unauthorized actor or actors accessed or copied certain company data between December 5, 2025 and February 12, 2026. The company says it identified the suspicious activity on or around February 27, 2026 and dated its notice letters July 17, 2026.Within days of those letters, proposed class actions began arriving in the U.S. District Court for the Central District of California in Los Angeles. The first, No. 2:26-cv-07917, was filed on July 20, 2026. Two more followed: No. 2:26-cv-08055 on July 22 and No. 2:26-cv-08602 on August 4. The first complaint alleges that ZenPatient did not adequately secure the health and personal information stored on its network and waited too long to tell people about the breach.
The suits are separate cases, and no order consolidating them appears on the record reviewed for this article. ZenPatient has not admitted wrongdoing. Its notice says it is not aware of any actual or attempted misuse of the data, and no court has ruled on whether any of the allegations are true.
Free settlement alerts
Get notified when new class actions open to claims
Join thousands of readers who get the latest class action settlements you may qualify for — delivered straight to your inbox.
Timeline of the Breach and the Lawsuits
The breach dates come from ZenPatient’s sample notice and its filing with the California Attorney General. The litigation dates come from the court docket.- December 5, 2025 to February 12, 2026 — An unauthorized actor or actors access or copy certain ZenPatient data, according to the company’s notice.
- On or around February 27, 2026 — ZenPatient identifies suspicious activity in its network and begins an investigation with outside cybersecurity specialists.
- On or about July 1, 2026 — ZenPatient finishes reviewing the affected data to identify the people it relates to.
- July 17, 2026 — ZenPatient’s notice letters are dated.
- July 20, 2026 — The first proposed class action, No. 2:26-cv-07917, is filed in the Central District of California.
- July 22, 2026 — A second suit, No. 2:26-cv-08055, is filed.
- July 29, 2026 — The first case is assigned to District Judge Michael W. Fitzgerald and Magistrate Judge Stephanie S. Christensen.
- August 4, 2026 — A third suit, No. 2:26-cv-08602, is filed.
- August 10, 2026 — A waiver of service executed on ZenPatient’s behalf is filed in the first case, making its response due September 29, 2026.
Two later entries in the first case, dated September 21 and September 22, 2026, carry no public description on CourtListener, so what they contain is not known.
What Information Was Involved
ZenPatient’s sample notice says each recipient’s name was in the affected data set together with other data elements. Those elements are filled in individually in each letter; in the public sample filed with the California Attorney General, the field is a blank placeholder, so the sample does not show which categories were involved for any particular person.The first complaint alleges that the information at issue included protected health information and personally identifiable information, and it names these categories:
- Diagnoses
- Dates of birth
- Treatment information
- Prescription and medication information
The complaint says this list is not exhaustive. The notice says ZenPatient secured its environment, notified federal law enforcement and added cybersecurity measures after the incident. It also offers recipients 12 months of Experian IdentityWorks credit monitoring and identity restoration services at no cost.
Who Is Affected
Neither the sample notice nor the first complaint gives a total number of affected people. The notice says approximately 52 Rhode Island residents may be affected. The complaint describes the group as thousands of people and, on information and belief, says thousands or millions may have been affected, without citing a specific count.The complaint says the two named plaintiffs in the first case are New York residents who received notice letters dated July 17, 2026, and that they learned of the breach only from those letters. It describes the people covered as those whose information ZenPatient received in connection with services they obtained.
What the Complaint Alleges
The first complaint alleges that ZenPatient failed to take reasonable steps to protect the information on its network, including failing to follow appropriate encryption practices, and that this allowed cybercriminals to get in. It points to the HIPAA Privacy and Security Rules and Section 5 of the Federal Trade Commission Act as sources of the standard of care, while stating that it does not bring direct HIPAA claims.The complaint also takes issue with the timing of the notice. It alleges that although ZenPatient says it discovered the breach on February 27, 2026, it did not begin informing people until July 17, 2026, and that the notice left them without enough detail about what was taken and what was being done to secure their information.
The plaintiffs say the breach has cost them time spent checking the notice, looking into credit monitoring and watching their accounts, and that it has caused anxiety and a lasting, increased risk of fraud and identity theft. They also allege a loss in the value of their information. The complaint does not describe any specific fraudulent charge or account opened in either named plaintiff’s name.
The Proposed Class
The first complaint seeks to represent a nationwide class of all individuals in the United States whose private information was exposed to unauthorized third parties as a result of the breach that ZenPatient reportedly discovered on or before February 27, 2026. Excluded are ZenPatient and its parents, subsidiaries, affiliates, officers and directors, any entity it controls, people who opt out, government entities, and the judges assigned to the case and their immediate families.The plaintiffs ask for certification under Federal Rules of Civil Procedure 23(b)(2) and 23(b)(3) and reserve the right to change the definition or add subclasses, for example based on the types of information compromised. No class has been certified. The other two suits may define their classes differently, and if the cases are later combined, a consolidated complaint could replace the individual ones.
Claims and Relief Sought
The first complaint brings three claims on behalf of the proposed nationwide class:- Negligence
- Breach of implied contract
- Breach of the implied covenant of good faith and fair dealing
It asks for actual, nominal and consequential damages in an amount to be determined, prejudgment interest, and attorneys’ fees and costs, and it demands a jury trial. No dollar figure is attached to the claims.
The complaint also asks for court orders requiring ZenPatient to encrypt the data it collects, delete information it cannot justify keeping, put in place a comprehensive information security program, use independent auditors for regular penetration testing and security audits, segment its network, scan its databases regularly, train and test employees on data security, and run a threat management program. One requested order would bar ZenPatient from keeping class members’ information in a cloud-based database. Another would require it to educate class members about the threats they face. The claims and requests described here come from the first complaint; the other two suits were not reviewed for this article and may plead different claims.
What Happens Next
When several class actions over the same breach land in one federal district, the court commonly consolidates them or relates them before a single judge, appoints interim lead counsel for the plaintiffs, and sets a schedule for one consolidated complaint. The defendant then typically answers or moves to dismiss, and the court decides which claims, if any, go forward. Cases that survive that stage move into discovery and a contested request for class certification.Many data breach class actions end in a negotiated settlement, but that is not a given in any particular case, and some are dismissed. If the ZenPatient cases settle, the court would have to approve the terms, and class members would generally receive notice and a chance to file a claim, object or opt out. None of that has happened here.
Is There Anything to Claim?
There is nothing to claim. The cases are at the complaint stage, no class has been certified, and there is no settlement, settlement website, claim form or deadline. The Experian credit monitoring described in ZenPatient’s notice is the company’s own offer and is separate from the lawsuits.Questions
Is there a ZenPatient data breach settlement?
There is no settlement. The proposed class actions against ZenPatient, Inc. in the U.S. District Court for the Central District of California are at the complaint stage. No class has been certified, and there is no settlement fund, claim form or deadline.
What information was involved in the ZenPatient data breach?
ZenPatient's sample notice says each person's name was in the affected data, along with other data elements that are listed individually in each letter and left blank in the public sample. The first complaint alleges the exposed information included diagnoses, dates of birth, treatment information and prescription or medication information.
How many people were affected by the ZenPatient data breach?
Neither ZenPatient's sample notice nor the first complaint gives a total. The notice says approximately 52 Rhode Island residents may be affected. The complaint describes the group as thousands of people and, on information and belief, as possibly thousands or millions.
When did ZenPatient notify people about the breach?
ZenPatient's notice letters are dated July 17, 2026. The notice says the company identified suspicious activity on or around February 27, 2026 and finished reviewing the affected data on or about July 1, 2026. The complaint alleges the gap of more than four months between discovery and notice was unreasonable.
Why would ZenPatient have health information?
According to the complaint, ZenPatient, Inc. is based in Playa Del Rey, California, and provides a software platform for telemedicine, patient communication, care workflows and prescription management. The complaint alleges that people had to provide their information to receive services and that ZenPatient stored it on its network.
Is ZenPatient's credit monitoring offer part of the lawsuit?
The 12 months of Experian IdentityWorks credit monitoring and identity restoration described in the notice is ZenPatient's own offer and is separate from the litigation. The sample notice gives an enrollment deadline of October 31, 2026. Neither the notice nor the complaint links the offer to the lawsuits.
Sources
• ZenPatient data breach suit, No. 2:26-cv-07917 (C.D. Cal.) — CourtListener docket• Class action complaint, ECF No. 1 (filed July 20, 2026) — PDF via CourtListener RECAP
• California Attorney General — ZenPatient, Inc. data security breach report
• ZenPatient sample notice letter dated July 17, 2026 — PDF via the California Attorney General
