Ciox Health LLC dba Datavant Group Data Breach — Class Action Review

Ciox Health LLC, doing business as Datavant Group, operates at the critical intersection of healthcare technology, data exchange, and clinical compliance. As a leading health data company, Datavant facilitates the secure transfer, linking, and management of massive repositories of electronic health records (EHRs) and patient health information (PHI) on behalf of hospitals, health systems, pharmaceutical companies, and insurance providers. Because the company serves as a vital clearinghouse and infrastructure provider for medical data, its systems hold deeply intimate and sensitive personal records for millions of individuals across the United States. This vast aggregation of medical and personal data makes Datavant an attractive and high-value target for cybercriminals seeking to exploit vulnerable health tech supply chains.

In 2025, Ciox Health LLC dba Datavant Group reported a significant data security incident to the New Hampshire Attorney General, triggering widespread concern among affected individuals. While specific forensic details continue to emerge, data breaches involving healthcare technology intermediaries typically involve sophisticated network intrusions, unauthorized access to centralized data repositories, or compromises of third-party vendor systems. In the health data sector, attackers frequently target the software infrastructure used to process medical release forms, insurance claims, and clinical records, exploiting software vulnerabilities or weak credential management to siphon out confidential files before detection.

The exposure of data through a health tech clearinghouse like Datavant creates severe, long-term risks for affected consumers. The compromised information typically includes full names, dates of birth, Social Security numbers, medical record numbers, health insurance policy details, and comprehensive clinical history including diagnoses, treatment notes, and prescription records. Unlike mutable credit card numbers, a compromised medical history, Social Security number, or date of birth cannot simply be changed. This immutable data exposes victims to perpetual risks of medical identity theft—where unauthorized parties obtain healthcare services using another person's insurance—as well as targeted financial fraud, health insurance fraud, and sophisticated phishing schemes designed to extract further personal and financial details.

As an entity handling protected health information, Ciox Health LLC dba Datavant Group was bound by rigorous legal and regulatory obligations under federal and state law, including the Health Insurance Portability and Accountability Act (HIPAA) Security and Privacy Rules, state consumer protection statutes, and common-law duties of care. These frameworks require healthcare technology vendors to implement robust administrative, physical, and technical safeguards—such as multi-factor authentication, end-to-end encryption, continuous network monitoring, and regular vulnerability assessments—to prevent unauthorized access to sensitive records. A successful data breach of this magnitude strongly indicates a failure to maintain adequate cybersecurity protocols, potentially violating these statutory mandates and breaching the implicit trust placed in the company by patients and healthcare providers alike.

Receiving a formal data breach notification letter from Ciox Health LLC dba Datavant Group serves as legal confirmation that your sensitive personal and medical information was compromised due to corporate negligence. Under modern data breach jurisprudence, the receipt of this notice establishes legal standing to participate in a class action lawsuit aimed at holding the company accountable for failing to safeguard your data. Importantly, victims do not need to wait until they suffer actual financial loss or medical fraud to seek legal redress; the increased, imminent risk of identity theft is itself a compensable harm. Our firm is actively investigating potential class action claims on behalf of affected individuals on a contingency fee basis, meaning there are never any out-of-pocket costs or attorney fees unless we successfully recover compensation for you.