Horizon Healthcare RCM Data Breach — Class Action Review

Horizon Healthcare RCM operates at the intersection of medical administration and financial services, serving as a revenue cycle management provider for hospitals, clinics, and physician practices. In this capacity, the company handles complex medical billing, insurance claims processing, patient registration, and payment collections. Because they manage the financial and administrative workflows for healthcare providers, Horizon Healthcare RCM routinely collects, processes, and stores vast quantities of highly sensitive Protected Health Information (PHI) and Personally Identifiable Information (PII) on behalf of millions of patients nationwide.

In 2025, Horizon Healthcare RCM formally reported a significant security incident to the New Hampshire Attorney General, alerting state regulators and affected individuals that their digital environment had been compromised. While security incidents affecting revenue cycle management firms often involve sophisticated cyberattacks—such as unauthorized access to database servers, ransomware deployments, or third-party software supply chain vulnerabilities—these breaches typically expose systemic weaknesses in network perimeter defenses and inadequate data segmentation. In the healthcare revenue sector, a breach can grant malicious actors unfettered access to centralized archives where patient demographics, insurance policies, and clinical financial records are consolidated.

The exposure of data through a revenue cycle management provider creates severe, multi-faceted risks for affected individuals. Compromised data sets frequently include full names, dates of birth, Social Security numbers, health insurance policy identifiers, and detailed medical billing or diagnosis codes. Unlike standard retail data breaches where credit cards can be cancelled, compromised medical and demographic data is immutable. Cybercriminals can exploit this information to commit medical identity theft—obtaining unauthorized treatments under a victim's name—file fraudulent health insurance claims, or leverage stolen identities for long-term financial fraud, tax schemes, and targeted phishing campaigns that mimic healthcare communications.

As an entity handling sensitive healthcare-related financial data, Horizon Healthcare RCM was bound by stringent federal and state legal obligations to secure and protect consumer information. Under the Health Insurance Portability and Accountability Act (HIPAA), the Federal Trade Commission (FTC) Act, and applicable New Hampshire state data privacy laws, the company had an affirmative legal duty to implement and maintain robust administrative, physical, and technical safeguards. The occurrence of a data breach of this magnitude strongly suggests potential failures in these mandated security controls, including inadequate encryption standards, delayed vulnerability patching, insufficient network monitoring, or a failure to properly vet third-party vendor access.

Receiving a data breach notification letter from Horizon Healthcare RCM serves as formal legal acknowledgment that your confidential information was compromised due to corporate negligence. Under modern data breach jurisprudence, this notification confirms that you have suffered an injury in fact, establishing the necessary legal standing to participate in a class action lawsuit. Affected individuals are not required to demonstrate immediate financial loss or out-of-pocket expenses to seek legal recourse and hold the company accountable. Our firm is currently investigating potential claims on a strict contingency fee basis, meaning there is never any out-of-pocket cost or financial risk to you unless we successfully recover compensation on your behalf.