Highland Health Systems Data Breach Settlement

The Highland Health Systems Data Breach Settlement covers only the people Highland Health's own records identify as exposed in the July 2023 targeted cyberattack the provider discovered on or about July 3, 2023. It is a closed list, not an open claim. This is not the Highlands Oncology Group data breach settlement, and it is not North Highland — those are separate, unrelated cases already on this site. The benefits here are part stacked and part either-or, and the difference matters: every class member may claim two years of medical identity protection AND one of two cash options, but the two cash options rule each other out. You take up to $5,000 for documented out-of-pocket losses, or an alternative cash payment expected to be $85 that needs no proof at all. The $5,000 is the ceiling on the documented-loss option only — it is not a cap on the settlement, and nobody collects both cash amounts. The $85 is an estimate, not a promise: the official settlement site says it may be larger or smaller depending on the total claims filed, and the $650,000 fund pays litigation costs, attorneys' fees and administration before any class benefits come out of it. Watch the split deadline: claims close October 28, 2026, but opting out or objecting closes a month earlier, on September 28, 2026.

Do I Qualify?

You may be eligible if:

• Highland Health's own records identify you as someone whose Private Information was exposed in the data breach it discovered on or about July 3, 2023 — this is a closed list drawn from the provider's records, not an open claim anyone can make
• You reside in the United States. The class is defined as all persons residing in the US whose Private Information was exposed in that breach
• You received the court-approved settlement notice by mail or email, or an earlier breach notice directly from Highland Health — either is a strong signal you are on the list, and the mailed notice carries the LoginID and PIN for the online form
• You do NOT need to have suffered identity theft or any loss. Nothing in the class definition or the alternative cash payment turns on harm — the no-proof cash option is open to any class member who files
• Check that this is the right Highland: this settlement is Highland Health Systems, an Alabama behavioral health provider sued in Calhoun County, Alabama. It is a different matter from the Highlands Oncology Group data breach settlement and from North Highland, both of which are separate cases covered elsewhere on SuitAlert
• You are not in an excluded group: the Defendants (Highland Health Systems, Mickey Turner and Allen Stokes), any entity in which they hold a controlling interest, Highland Health's officers, directors, legal representatives, successors, subsidiaries and assigns, and any judge or judicial officer presiding over the matter with their immediate families and judicial staff are all outside the class
• You file a valid claim form online, by email or postmarked by October 28, 2026 — and if you wanted to opt out or object instead, that window closes a month earlier, on September 28, 2026

There are two separate questions here: getting into the form, and proving your claim. Getting in. The online claim form opens with a LoginID and PIN printed on the notice mailed to you — but that is not a hard gate. The same login page publishes a link to file a claim without your LoginID and PIN at highlanddatabreachsettlement.com/form/open, the administrator will re-issue credentials if you email your full name and mailing address to info@HighlandDataBreachSettlement.com, and a printable claim form can be returned by email or post instead. Proving the claim. This depends entirely on which cash option you pick. For the alternative cash payment expected to be $85, nothing at all — the settlement site states you do not have to provide any proof or explanation. For documented losses up to $5,000, you must submit proof such as receipts showing what you spent or lost, for losses incurred between July 3, 2023 and October 28, 2026. Your own certification, declaration or affidavit does not count as reasonable documentation on its own, though you may attach one to give context to real records. Expenses already reimbursed by a third party cannot be claimed.

What Happened?

A targeted cyberattack hit Highland Health Systems' computer systems in July 2023, and Highland Health discovered the breach on or about July 3, 2023. Certain files containing Private Information were accessed.

The categories of data involved are unusually broad. According to the court-authorized notice, the files may have contained full names, addresses, telephone numbers and email addresses, together with date of birth, Social Security number, account number, payment card number, payment card PIN, email address and password, medical information and health insurance information, tax ID, routing number, and driver's licence or state ID. That combination — a Social Security number alongside a routing number, a card PIN, a reusable password and health data — is what the settlement's medical identity protection benefit is built around.

The case is Weyerman, et al. v. Highland Health Systems, et al., Case No. 2024-CV-900370, in the Circuit Court for Calhoun County, Alabama, before the Honorable Jennifer G. Weems. The defendants are Highland Health Systems, Mickey Turner and Allen Stokes. Highland Health denies that it did anything wrong and the court has not decided who is right; the parties settled to avoid the costs, risks, disruptions and uncertainties of continuing the litigation.

Highland Health agreed to create a $650,000 settlement fund. The court will hold the final approval hearing on November 30, 2026 at 2:00 p.m. Central Time at 25 W 11th Street, Anniston, AL 36201; the settlement site warns the date and time can change without further notice. Class members do not have to attend. Payments are distributed only if the court grants final approval and after any appeals are resolved.

How to File Your Claim

1. File online at highlanddatabreachsettlement.com/form/claim using the LoginID and PIN printed on the notice mailed to you
2. No LoginID and PIN? You are not shut out — the same login page publishes a "file a claim without your LoginID and PIN" link at highlanddatabreachsettlement.com/form/open, and the administrator will re-issue your credentials if you email info@HighlandDataBreachSettlement.com with your full name and mailing address
3. Prefer paper? Download the claim form from the settlement website and return it by email to info@HighlandDataBreachSettlement.com or by post to Highland Health Data Breach Settlement, c/o Settlement Administrator, P.O. Box 25226, Santa Ana, CA 92799-9958
4. DECIDE YOUR CASH OPTION FIRST: you may claim documented losses up to $5,000 OR the alternative cash payment expected to be $85, but not both — the two cash options exclude each other
5. TICK THE MEDICAL IDENTITY PROTECTION BOX EITHER WAY: the two years of monitoring is on top of your cash option, not instead of it, and every class member is eligible for it
6. If you are claiming documented losses, attach receipts or similar records — your own certification, declaration or affidavit is not reasonable documentation on its own
7. SPLIT DEADLINE: the claim form must be submitted online or by email, or postmarked, no later than October 28, 2026, but the deadlines to opt out or to object are both September 28, 2026, a month earlier
8. Questions: call the administrator toll-free 24/7 on (833) 421-7352 or email info@HighlandDataBreachSettlement.com
9. Visit the official claim form: https://www.highlanddatabreachsettlement.com/

How Much Will I Actually Get?

The structure is a hybrid, and reading it as a simple either-or costs you money. All Settlement Class Members may claim Medical Identity Protection AND one of two Cash Payment options — the monitoring stacks on top of the cash rather than replacing it. MEDICAL IDENTITY PROTECTION: two years of CyEx Medical Shield Total with three-bureau monitoring, $1 million of medical identity theft insurance, and monitoring for healthcare insurance ID exposure, Medical Record Number (MRN) exposure and unauthorized Health Savings Account (HSA) spending, with a fraud resolution agent if something surfaces. Every class member is eligible; it costs nothing and does not reduce your cash. THEN ONE CASH OPTION, NOT BOTH. (1) Documented Losses: actual, documented out-of-pocket losses caused by the breach, up to $5,000, for losses incurred between July 3, 2023 and October 28, 2026 — identity theft or fraud losses, fees for credit reports, credit monitoring or credit freezes and unfreezes, the cost of replacing IDs, and postage to contact banks by mail. Receipts required, and anything already reimbursed by a third party cannot be claimed. (2) Alternative Cash Payment: instead of documented losses, a one-time payment expected to be $85.00, with no proof and no explanation required. TWO THINGS THE HEADLINE NUMBERS HIDE. The $5,000 is the ceiling on the documented-loss option alone — it is not a cap on the settlement, and it is not something an $85 claimant can also reach for. And the $85 is an estimate: the official settlement site says plainly that it "may be larger or smaller depending on the total claims filed." The $650,000 settlement fund is used first for the costs of litigation, attorneys' fees and administration — class counsel will ask for up to one-third of the fund plus up to $30,000 in costs, and $3,500 service awards for each of the two class representatives — and only the net fund pays class benefits. If you have receipts totalling more than about $85, documenting them is likely worth more; if your losses are small or hard to evidence, the flat option cannot be rejected for thin paperwork. No money moves until the court approves the settlement at the November 30, 2026 final approval hearing and any appeals are resolved.

Last reviewed: September 18, 2026 | Information verified from court records and official settlement documents.

Frequently Asked Questions