Rectangle Health Data Breach — Class Action Review

Rectangle Health operates as a specialized healthcare technology and financial solutions provider, serving medical practices, hospitals, and dental organizations across the country. Their platform bridges the gap between clinical operations and patient financial engagement, managing vital administrative workflows such as payment processing, patient registration, and account management. Because of this core function, Rectangle Health and its infrastructure act as a massive repository for highly sensitive patient information and practice management data, sitting at the intersection of sensitive medical records and critical financial transactions.

In 2025, Rectangle Health reported a significant cybersecurity incident to the New Hampshire Attorney General's office, prompting widespread concern among affected patients and healthcare providers. While the exact initial vector of the intrusion is still being fully analyzed, incidents involving healthcare technology vendors typically arise from sophisticated cyberattacks, unauthorized access to centralized databases, or third-party software vulnerabilities. Because companies like Rectangle Health aggregate administrative and financial data from numerous medical practices, a single point of failure in their network can expose vast quantities of interconnected records, making them prime targets for malicious actors seeking to exploit high-value health data.

The exposure of data through a healthcare technology platform like Rectangle Health creates severe, multi-layered risks for impacted individuals. Typically, breaches of this nature compromise combinations of full names, dates of birth, Social Security numbers, health insurance details, and specific medical billing or treatment histories. Unlike standard retail breaches where stolen credit cards can simply be cancelled, exposed medical and financial identifiers cannot be easily replaced. This creates long-term exposure to medical identity theft—where unauthorized parties receive care under a victim's name—as well as targeted financial fraud, compromised insurance claims, and persistent phishing schemes designed to exploit the specific healthcare context of the victims.

As a custodian of protected health information and financial data, Rectangle Health was bound by stringent legal and regulatory frameworks, including the Health Insurance Portability and Accountability Act (HIPAA), the Gramm-Leach-Bliley Act (GLBA) where applicable, and state-level consumer protection statutes. These laws impose rigorous administrative, physical, and technical safeguards to secure electronic protected health information and prevent unauthorized access. The occurrence of a data breach of this scale strongly suggests potential failures in maintaining adequate cybersecurity defenses, encrypting sensitive repositories, or monitoring network activity, thereby breaching both statutory duties and implied contracts with the patients and providers they serve.

For individuals who have received a data breach notification letter from Rectangle Health, this communication serves as formal legal confirmation that their private information was compromised due to corporate negligence. Legally, receiving this notice establishes the concrete injury and standing necessary to participate in a class action lawsuit aimed at holding the company accountable. Importantly, affected individuals do not need to prove that they have already suffered actual financial loss or medical fraud to seek legal recourse; the increased and imminent risk of future harm is sufficient. Our law firm is investigating potential claims on a contingency fee basis, meaning there is never any out-of-pocket cost or financial risk to class members unless a recovery is successfully secured.