Published
September 18, 2026
People whose personal or health information was exposed in the July 2023 cyberattack on Highland Health Systems may qualify to claim an estimated $85 cash payment, or up to $5,000 for documented losses, from the $650,000 Highland Health data breach class action settlement. Claims close October 28, 2026, and every class member can also claim two years of medical identity protection on top of the cash.
Current Status
Claims are open, and this is the last stretch. The Claim Form must be submitted online or by email, or postmarked, no later than October 28, 2026. The deadlines to opt out or object both passed on September 28, 2026, so anyone who did nothing is now in the class and will be bound by the release whether or not they file. The settlement is not yet approved: the Final Approval Hearing is set for November 30, 2026 at 2:00 p.m. Central Time before the Honorable Jennifer G. Weems in Anniston, Alabama, and the notice warns that the date and time can change without further notice. No payment date has been announced, and none can be until the court approves the settlement and the judgment becomes final. Filing is free and takes minutes if you take the flat cash option, which requires no documentation at all.Free settlement alerts
Get notified when new class actions open to claims
Join thousands of readers who get the latest class action settlements you may qualify for — delivered straight to your inbox.
Status
Claims Open
final approval hearing November 30, 2026 · not yet approved
Claim Deadline
October 28, 2026
submitted online or by email, or postmarked · the opt-out and objection deadlines passed September 28, 2026
Estimated Payout
~$85 or up to $5,000
estimate only · the $85 pro rata cash payment is paid last out of the $650,000 fund, so it moves up or down with the number of claims · or up to $5,000 for documented losses instead · every claimant can also take two years of medical identity protection
Proof Required
Yes — Login ID & PIN
the online form opens with the Login ID and PIN from your mailed notice, though the site also publishes a link to file without them and the paper form marks the Login ID "if known" · no receipts for the $85 option, only for documented losses
What Changed Recently?
The settlement reached the stage where it matters to you: notice went out, the claims period opened, and the window is now inside its final month. The opt-out and objection deadlines came and went on September 28, 2026, which is why the only decision left for most class members is whether to file.The lawsuit was filed in 2024 in the Circuit Court of Calhoun County, Alabama, and consolidated claims brought on behalf of people notified of the breach. The parties negotiated a settlement, the court granted preliminary approval, and the administrator began notifying the class. The claims period runs ninety days from the date notice was issued, which is how the October 28 deadline was set.
None of this is a finding against anyone. Highland Health denies that it did anything wrong, the court has not decided who is right, and the parties say they settled to avoid the costs, risks, disruptions and uncertainties of continuing the litigation.
What Happened in the Breach
Highland Health Systems is a behavioral health provider based in Anniston, Alabama. The settlement documents describe a targeted cyberattack on its computer systems in July 2023, discovered on or about July 3, 2023, in which certain files containing private information were accessed.The categories of data involved are unusually broad for a breach of this size. According to the court-approved notice, the files may have contained full names, addresses, telephone numbers and email addresses, together with dates of birth, Social Security numbers, account numbers, payment card numbers and payment card PINs, email addresses and passwords, medical information and health insurance information, tax IDs, routing numbers, and driver's licence or state ID numbers.
That combination is worth taking seriously. A breach that pairs a Social Security number with a bank routing number, a payment card PIN and a reusable password gives an attacker more than one route, and the medical and health-insurance element is what the settlement's monitoring benefit is built around.
The lawsuit alleged that the breach happened because of inadequate data security. The settlement agreement records that Highland Health has adopted, paid for and implemented certain information-security changes, described to class counsel in a confidential affidavit rather than filed publicly. Those changes are expressly not injunctive relief, and the agreement states that no class member has standing to enforce them.
Who Qualifies?
The settlement class is all persons residing in the United States whose private information was exposed to unauthorized third parties as a result of the data breach Highland Health discovered on or about July 3, 2023. The settlement agreement puts the class at approximately 83,543 people, identified from Highland Health's own records.A few points decide most eligibility questions:
- Membership comes from Highland Health's records, not from where you live now. The class is defined by exposure in the breach; "United States" in the agreement covers all fifty states, the District of Columbia and all territories.
- You do not need to have suffered identity theft. Nothing in the class definition or the pro rata cash option turns on harm — the flat payment is available to any class member who files.
- Many class members were already told. Highland Health sent its own breach notice at the time, and the settlement administrator has since mailed and emailed the court-approved notice; receiving either is a strong signal you are on the list.
- Anyone who opted out by September 28, 2026 is excluded, as are the defendants, entities they control, Highland Health's officers, directors, legal representatives, successors, subsidiaries and assigns, and any judicial officer presiding over the case along with their immediate families and staff.
How Much Can You Get?
Highland Health is funding a $650,000 non-reversionary common fund, which matters: nothing left over goes back to the defendants. Out of it come the costs of notice and administration, court-approved attorneys' fees and expenses, service awards, and the class benefits themselves.Every class member can claim two things — the monitoring, plus one of the two cash options:
- Medical identity protection, two years. CyEx Medical Shield Total with three-bureau credit monitoring and $1,000,000 in identity theft insurance. Beyond ordinary credit monitoring it watches for healthcare insurance ID exposure, Medical Record Number exposure and unauthorized Health Savings Account spending, with a fraud resolution agent available if something surfaces. This is not an alternative to the cash — you can take both.
- Documented losses, up to $5,000. For actual out-of-pocket losses caused by the breach and incurred between July 3, 2023 and October 28, 2026: losses from identity theft or fraud, fees for credit reports, credit monitoring or credit freezes and unfreezes, the cost of replacing IDs, and postage to contact banks by mail. Anything already reimbursed by a third party is out.
- Or a pro rata cash payment, estimated at $85. One flat payment instead of documented losses, with no proof and no explanation required.
Class counsel may ask the court for attorneys' fees of up to one-third of the fund and expenses of up to $30,000, and the defendants have agreed not to object to a service award of $3,500 for each of the two class representatives. All of that is paid out of the $650,000, and the court decides the amounts at the November hearing.
The $85 Is Paid Last, Which Is Why It Can Move
The estimate deserves a closer look than most settlement figures, because of where it sits in the queue.The settlement agreement sets an explicit order of payment out of the fund: first the cost of settlement administration, then valid documented-loss claims, then all the medical identity protection codes, then any attorneys' fees and litigation expenses awarded, then any service awards — and last, the pro rata cash payments. The agreement then defines the pro rata payment as what is left after all of that, divided by the number of eligible claims, "adjusted upwards or downwards based upon the number of Valid Claims filed."
Two practical consequences follow. The $85 is a projection rather than a promise, and it is the benefit most exposed to how the rest of the claims come in — a heavy volume of documented-loss claims or of monitoring sign-ups reduces what is left for it. But the same mechanism runs the other way: on a class of 83,543 people, data breach settlements routinely see single-digit claim rates, and a low turnout leaves the residual spread across fewer claimants.
The reason to mention it at all is that it changes what a borderline documented-loss claim is worth. If you have real receipts totalling more than about $85, documenting them is likely the better option; if your losses are small, uncertain, or hard to evidence, the flat payment costs nothing to claim and cannot be rejected for thin paperwork.
What Proof Is Required?
This settlement has two different answers depending on which cash option you take, and the distinction is the whole ballgame for most people.For the pro rata cash payment, nothing. The notice and the claim form both say you do not have to provide any proof or explanation to claim it. You tick the box, pick how you want to be paid, and sign.
For documented losses, real records. You have to send proof such as receipts showing what you spent or lost, and the claim form asks you to list each item with a description of the documentation you are attaching and the amount. The notice is blunt about what does not count: your own certification, declaration or affidavit is not reasonable documentation on its own, though you may attach one to give context to records you do provide.
Getting into the online form is a separate question from proving your claim. The settlement website says the online claim form opens with the Login ID and PIN printed on the notice mailed to you, and in the same breath publishes a link to file a claim without them; the downloadable paper form marks the Login ID field "if known" and can be returned by email or mail. If your credentials are lost, the administrator will re-issue them on request through the contact route on the settlement website once you supply your full name and mailing address.
Payment options are broader than most settlements offer: PayPal, Venmo, Zelle, a virtual prepaid card, or a physical cheque. The form is signed under penalty of perjury and claims are subject to verification, so the administrator may come back for more information before treating one as complete.
What Is the Deadline?
The Claim Form must be submitted online or by email, or postmarked, no later than October 28, 2026. The claims period is the ninety-day window the settlement agreement provides for, running from the date notice was issued.Everything else has already closed. Opt-out requests and objections were both due September 28, 2026. Opting out was the only route that preserved the right to sue Highland Health separately over the breach, and that route is now shut — which means a class member who does nothing gives up those claims and receives nothing in return. Filing is the only way to get anything back for a release that will bind you either way.
How Do You Take Action?
File on the official settlement website, Highland Data Breach Settlement, administered by Simpluris under the court's direction. The site carries the claim form, the long-form notice and the settlement agreement, and it is also where a downloadable paper claim form lives for anyone who would rather file by email or post. Filing is free and you do not need a lawyer — class counsel's fees come out of the fund, not out of your pocket.In practice: decide first whether you are claiming documented losses or the flat payment, because that choice drives everything else. If you are claiming losses, gather the receipts before you start and list each one against the amount. Tick the medical identity protection box either way — it is free, it is on top of the cash, and it is the part of this settlement built for the health-data element of the breach. Then pick a payment method and sign.
What Happens Next?
The court holds the Final Approval Hearing on November 30, 2026 at 2:00 p.m. Central Time in Anniston. It will decide whether to approve the settlement, and will rule on class counsel's request for fees and expenses and on the service awards. Class members do not need to attend.Approval alone does not release money. Payments are issued by cheque or electronically within thirty days of the Effective Date, or within twenty-one days of a claim being approved, whichever is later — and the Effective Date is ten days after the judgment becomes final, meaning after any appeal period has run. If a claim is incomplete or unsigned, the administrator asks for what is missing and allows twenty-one days to cure it before rejecting it, with a claims referee available for disputes whose decision is final and non-appealable.
One termination right is worth knowing about. If more than 100 people opted out, or more than 0.15% of the notices mailed, whichever is greater, the defendants had the right to terminate the settlement outright. That window is tied to the opt-out date that has now passed, so any exercise of it would surface before the hearing.
The release is broad, but it carves out one thing explicitly: it does not cover claims sounding in medical malpractice that a class member may have against Highland Health. Those survive the settlement.
Sources and Verification
• Official settlement website, claim form and court documents — Highland Data Breach Settlement, administered by Simpluris, for the deadlines, the benefit descriptions and the online filing requirements• Notice of Proposed Class Action Settlement, authorized by the Circuit Court for Calhoun County, Alabama — the source for the class definition, the data categories involved, the benefit tiers, the fee and service-award requests and the hearing date — embedded below
• Data Breach Settlement Claim Form, for the documentation rules, the one-or-the-other cash election and the payment methods
• Class Action Settlement Agreement and Release, for the 83,543 class size, the non-reversionary $650,000 fund, the order in which the fund is paid out, the pro rata calculation, the claim-cure and claims-referee procedure, the termination threshold and the medical-malpractice carve-out
• Weyerman, et al. v. Highland Health Systems, et al., Case No. 11-CV-2024-900370-JGW, Circuit Court of Calhoun County, Alabama (Hon. Jennifer G. Weems)
Questions
Can I take the medical identity protection and a cash payment?
Yes. The two are not an either-or. Every settlement class member may claim the two years of medical identity protection and one of the two cash options. The choice you have to make is between the cash options themselves: documented losses up to $5,000, or the flat pro rata payment estimated at $85. You cannot claim both of those, and the claim form says so in capital letters.
Why might the $85 payment come out lower?
Because it is paid last. The settlement agreement sets an order for the $650,000 fund: administration costs first, then documented-loss claims, then the medical identity protection codes, then attorneys' fees and expenses, then the service awards — and only what survives all of that is divided among the pro rata cash claims. So the figure moves with how many people claim and how much the documented-loss claims come to. The agreement says plainly that it will be adjusted upwards or downwards based on the number of valid claims filed.
Do I need receipts to get the $85?
No. The pro rata cash payment asks for no proof or explanation at all — the claim form is explicit about that. Documentation is only needed for the other option, the documented-losses claim of up to $5,000, and there the bar is real: receipts or similar records, with the losses falling between July 3, 2023 and October 28, 2026. Your own certification, declaration or affidavit does not count as documentation on its own, though you can attach one to explain records you do provide.
I can't find the Login ID and PIN from my notice. Can I still file?
The settlement website says the online claim form opens with the Login ID and PIN printed on the notice that was mailed to you, and it also publishes a separate link to file without them. The downloadable paper claim form treats the Login ID as optional, marking the field "if known", and it can be returned by email or mail. If you cannot locate your credentials, the administrator will re-issue them when you supply your full name and mailing address — the settlement website has the contact route.
Does this settlement give up a malpractice claim against Highland Health?
No. The release in the settlement agreement is broad and covers essentially every claim arising out of the data breach, but it carves out one category expressly: released claims do not include claims sounding in medical malpractice that a plaintiff or settlement class member may have against Highland. That carve-out is in the agreement's definition of Released Claims.
What happens if the administrator says my claim is incomplete?
You get a chance to fix it. On an incomplete or unsigned claim form the administrator asks for the missing information and gives you twenty-one days to cure the defect before rejecting the claim, with an extension available for good cause such as illness or mail failure. If a dispute remains, it goes to a claims referee whose decision is final and cannot be appealed.
Official Settlement Notice
For more class actions keep scrolling below.
Settlement Amount
$650,000
a non-reversionary common fund — nothing left over returns to the defendants
Case Title
Weyerman, et al. v. Highland Health Systems, et al.
Case Number
11-CV-2024-900370-JGW
also cited as Case No. 2024-CV-900370
Court
Circuit Court of Calhoun County, Alabama — Hon. Jennifer G. Weems
People Affected
About 83,543
identified from Highland Health's own records · breach discovered on or about July 3, 2023
Final Approval Hearing
November 30, 2026 at 2:00 p.m. CT
Anniston, Alabama — the date and time can change without further notice
Administrator
Simpluris
Official Website
Highland Data Breach Settlement
