Report on Patient 25, no. 7 (July, 2025)
In the 18 months since the Change Healthcare breach occurred, class action suits—filed by both patients and providers—continue to multiply, with no resolution yet in sight. In fact, in late June, the Minnesota judge presiding over the federal cases put another judge in the state on notice that he was in charge, while recognizing the state court’s jurisdiction.
The June 30 letter from U.S. District Judge Donovan W. Frank, with the District of Minnesota, to Judge Shawn M. Moynihan, a senior district judge in Dakota County, also provides a revealing update on the federal cases—at that point there were 90—and dozens of others percolating across the U.S.[1]
In addition to Frank’s letter to Moynihan, another recent development is his May 21 ruling granting providers’ motion for court supervision of communications between them and UnitedHealth Group officials, who Frank said committed misconduct related to loan repayment negotiations.[2]
In February of last year, a ransomware attack against Change—facilitated by the lack of multifactor authentication—exposed some 190 million individuals’ protected health information and crippled the flow of payments to providers nationwide. UnitedHealth, the parent of Change, loaned $9.03 billion to more than 10,000 providers as part of its Temporary Funding Assistance Program (TFAP) to help them function during disruptions in its claims processing.
“Obtaining releases from putative class members without informing them that a proposed class action has been filed is the textbook definition of abusive communications between defendants and putative class members,” Frank ruled.
However, at the same time, Frank denied the providers’ motion for declaratory judgment and patients’ motion for a preliminary injunction.
A year ago, recognizing that “a number of federal Change Healthcare cases involve common questions of fact and that the centralization was important,” a judicial panel on multidistrict litigation (MDL) ordered the plethora of class action suits related to the breach to be transferred “and assigned to me to coordinate discovery and other pretrial matters,” Frank told Moynihan. The cases under Frank are collectively referred to as MDL litigation.
For those who want to follow along in detail: In an order dated July 3, Frank explained that the plaintiffs, per his direction, “filed two new actions in the District of Minnesota, one on behalf of patients (the ‘Individual Track’), Christenson, et al. v. UnitedHealth Grp. Inc., et al., No. 25-cv-183, and one on behalf of providers (the ‘Provider Track’), Total Care Dental & Orthodontics, et al. v. UnitedHealth Grp. Inc., et al., No. 25-cv-179.” These were filed Jan. 15. Each track has its own consolidated class action complaint.
Patients’ complaint alleges UnitedHealth had “severe security deficiencies” and seeks a minimum of five years’ credit monitoring; actual, compensatory and statutory damages; and attorney fees.
The providers’ complaint seeks damages, attorney fees and loan forgiveness. Other demands include requiring UnitedHealth to establish “appropriate security measures,” “processes and contingency plans to protect critical infrastructure technology and avoid further sudden and sustained service outages” and to “create and robustly fund and staff a system to promptly resolve claim and payment backlogs and assist Providers…with information and financial support needed to respond to ongoing questions and/or ‘late’ claim penalties.”
Multiple Committees Assisting Federal Judge
The subject of Frank’s letter is a case health care consultant Dustin Nides of Mendota, Minn., filed on May 2. It is one of six new state cases related to the cyberattack that have been filed since April 23, according to an update UnitedHealth attorney Allison M. Holt Ryan, a partner with Hogan Lovells, sent Frank on June 23. This correspondence likely prompted Frank’s letter to Moynihan, which apparently is one of five Frank has written to other state judges.
In states that are coordinating their cases with Frank, relevant discovery will be shared and “specific guidelines for deposition practice, requiring nonplaintiff depositions to be noticed in the MDL as to provide MDL counsel an opportunity to participate” will be adopted, Frank explained. All parties in state and federal actions are “entitled to copies of written discovery.”
Frank’s letter to Moynihan also described how he has managed the enormous case. He created a Lead Counsel Committee and a Plaintiffs’ Steering Committee and appointed separate liaison counsels, including for the District of Minnesota, the state courts and the defendants. Magistrate Judge Dulce J. Foster is also assisting Frank with “these cases for specialized pretrial issues.”
“I was a state court judge for 14 years here in Minnesota,” Frank wrote. “As a result of my state court experience, I am aware of and sensitive to issues confronting state court judges when they have individual cases involved in an MDL case. In setting a schedule for the MDL case, I am mindful of the balance necessary to serve the interests of justice and the parties. On the one hand, the Court must ensure that these cases proceed expeditiously through the Court’s efforts to coordinate discovery and move toward trial. Yet, on the other hand, the Court must ensure that the cases are not brought to trial in too hasty a manner, leading to a verdict for either side that does not represent a fair attempt at discovery and thus does not characterize the essence of the lawsuits.”
As the case proceeds, next up is a scheduling conference planned for July 17. Frank invited Moynihan to listen-in remotely.
Frank’s ruling on communications was opposed by UnitedHealth attorneys, but he agreed with providers that firm officials committed “serious misconduct” related to “misleading communication” by pursuing releases from providers without mentioning the MDL cases and the fact that there is a dispute over whether Change could collect repayment of TFAP loans.
Future Correspondence Must Mention Litigation
Frank ordered UnitedHealth to insert “in all future communications regarding a release of claims in exchange for TFAP loan forgiveness or a delay on TFAP loan collection” the following:
“Please be advised that the timing of payment collection on the Temporary Funding Assistance Program (TFAP) loans is currently being disputed in ongoing federal, multi-district litigation in the District of Minnesota. Signing this release will prevent your involvement in that litigation. You may wish to consult an attorney before signing.”
The titling of the suit and link to the case website also must be included in correspondence, Frank ruled.
In a June 9 filing in response to Frank’s ruling, UnitedHealth attorneys said firm officials “remain adamant that they have been open and honest in negotiations with providers, and do not believe the record supports the Order’s finding of actual misconduct (as opposed to threatened misconduct).”
“Defendants confirm to the providers named in the Consolidated Complaint (as well as Odom Health) that Defendants rescind prior repayment requests to those providers and will not seek to collect any TFAP amounts these providers received until the merits of TFAP loan collection have been adjudicated by this Court,” wrote Ryan.
She added that UnitedHealth officials will “include the Court’s language in any future communications with putative class members regarding a release of claims in exchange for TFAP loan forgiveness or a delay on TFAP loan collection” and are “working to provide the Court and Plaintiffs’ Counsel with a list of putative class members from which they have obtained releases to date. The list will identify putative class members with which Defendants have settled damages claims related to the Cyberattack.”
1 U.S. District Judge Donovan W. Frank, U.S. District Court of Minnesota, “Re: MDL 3108 Change Healthcare et al.,” letter to Hon. Shawn M. Moynihan, June 30, 2025, https://bit.ly/3GduXix.
2 U.S. District Judge Donovan W. Frank, U.S. District Court of Minnesota, “Memorandum Opinion and Order,” MDL No. 24-3108 (DWF/DJF), May 21, 2025, https://bit.ly/3TLmrul.
[View source.]
