Frequently Asked Questions

A Court authorized this Settlement Website to inform you how you may be affected by this proposed Settlement. This Settlement Website describes the lawsuit, the general terms of the proposed Settlement and what it may mean to you. This Settlement Website also explains how to participate in, or exclude yourself from, the Settlement if your information may have been impacted in the NextGen Healthcare Data Breach.

For information on how to determine if you are a Settlement Class Member, and therefore eligible for benefits under this Settlement, see Question 6.

The Action alleges that NextGen Healthcare failed to properly protect personal information in accordance with its duties, had inadequate data security, and violated certain state consumer statutes and other laws. On April 28, 2023, NextGen Healthcare announced that it had detected a third-party criminal cyberattack in which the attacker was able to gain unauthorized access to patient data.

Various lawsuits were filed related to the Data Breach, which were consolidated and are now known as Miller v. NextGen Healthcare Inc., Case No. 1:23-cv-02043-TWT. The persons who filed this Action are called the Settlement Class Representatives. The Settlement Class Representatives claim that Defendant did not adequately protect consumers’ personal information. The most recent version of the Complaint in this Action, which describes the Settlement Class Representatives’ claims in detail, is available in the Documents section of this Settlement Website. Defendant denies the claims and contentions alleged in the Action. The Court did not decide which side was right. But both sides considered the uncertain outcome and risk of further litigation and agreed to the Settlement. Settlements avoid the costs and uncertainty of a trial and related appeals, while more quickly providing benefits to Settlement Class Members.

In a class action, one or more people called “Settlement Class Representatives” sue on behalf of themselves and other people with similar claims. All of these people together are the “Settlement Class” or “Settlement Class Members.” Because this is a class action Settlement, even persons who did not file their own lawsuit can obtain benefits provided under the Settlement, except for those individuals who exclude themselves from the Settlement Class by the deadline.

The Court has not decided in favor of the Settlement Class Representatives or Defendant. Instead, both sides agreed to a Settlement after a lengthy mediation process overseen by a neutral mediator. Settlements avoid the costs and uncertainty of a trial and related appeals, while more quickly providing benefits to Settlement Class Members. The Settlement Class Representatives appointed to represent the Settlement Class and the attorneys for the Settlement Class (Class Counsel, see Question 14) believe that the Settlement is in the best interests of the Settlement Class Members.

You are a Settlement Class Member if you have been identified by NextGen Healthcare as a person whose Private Information may have been impacted by the Data Breach. All identified Settlement Class Members were mailed notice of the proposed Settlement, so if you received a notice, you are a likely Settlement Class Member.
You can also confirm you are a Settlement Class Member, and eligible for benefits, by:

• Visiting this Settlement Website; or
• Calling 833-630-5369. 

Excluded from the Settlement are:

• NextGen Healthcare, any Entity in which NextGen Healthcare has a controlling interest, and NextGen Healthcare’s officers, directors, legal representatives, successors, subsidiaries, and assigns; 
• Any judge, justice, or judicial officer presiding over the Action and the members of their immediate families and judicial staff; and 
• Any individual who timely and validly opts out of the Settlement (see Question 17).

The Defendant will make a non-reversionary payment of $19,375,000 into an escrow account to establish the Settlement Fund. The Settlement Fund will be used to pay:

• Notice Costs;
• Administrative Costs;
• Service Awards approved by the Court;
• Attorneys’ Fees and Expenses approved by the Court; and
• Settlement benefits for the Settlement Class as provided for in the Settlement Benefits Plan.

A description of these commitments is available in the Settlement Agreement, which is available in the Documents section of this Settlement Website.

Settlement Benefit: Cash Payment for Out-of-Pocket Losses: If you spent money to deal with fraud or identity theft that you believe was fairly traceable to the Data Breach, or to protect yourself from future harm as a result of the Data Breach, then you can submit a claim for reimbursement. Out-of-Pocket Losses that are eligible for reimbursement may include, without limitation, the following:

• unreimbursed costs, expenses, losses or charges incurred as a result of identity theft or identity fraud, falsified tax returns, or other alleged misuse of a Settlement Class Member’s personal information;
• costs incurred on or after March 29, 2023, associated with placing or removing a credit freeze on a Settlement Class Member’s credit file with any credit reporting agency;
• other miscellaneous expenses incurred on or after March 29, 2023, related to any Out-of-Pocket Loss such as notary, fax, postage, copying, mileage, and long-distance telephone charges;
• costs of credit reports, credit monitoring, or other products related to detection or remediation of identity theft incurred on or after March 29, 2023, through the date of the Settlement Class Member’s claim submission.

This list provides examples only, and other losses or costs that you believe are fairly traceable to the Data Breach may also be eligible for reimbursement.

To claim reimbursement for Out-of-Pocket Losses, Settlement Class Members with Out-of-Pocket Losses must submit Reasonable Documentation supporting their claims. “Reasonable Documentation” means documentation supporting your claim, including, but not limited to, credit card statements, bank statements, invoices, telephone records, and receipts. Except as expressly provided in this notice, personal certifications, declarations, or affidavits from the claimant do not constitute Reasonable Documentation but may be included to provide clarification, context or support for other submitted Reasonable Documentation.

The Settlement Administrator will decide if your claim for Out-of-Pocket Losses is valid and fairly traceable to the Data Breach. In assessing what qualifies as “fairly traceable,” the Settlement Administrator must consider: (1) the timing of the loss, including whether the loss occurred on or after March 29, 2023, through the date of the Settlement Class Member’s claim submission; (2) whether the loss involved the possible misuse of the type of personal information compromised in the Data Breach; (3) whether the personal information compromised in the Data Breach that is related to the Settlement Class Member is of the type that was possibly misused; (4) the Settlement Class Member’s explanation as to how the loss is fairly traceable to the Data Breach; (5) the nature of the loss, including whether the loss was reasonably incurred as a result of the Data Breach; and (6) any other factor that the Settlement Administrator considers to be relevant. The Settlement Administrator shall have the sole discretion and authority to determine whether claimed Out-of-Pocket Losses are valid and fairly traceable to the Data Breach. Only valid claims will be paid.

The deadline to file a claim for Out-of-Pocket Losses is March 30, 2026.

Settlement Benefit: Cash Payment for Lost Time: If you spent time 1) remedying fraud, identity theft, or other misuse of a Settlement Class Member’s Private Information that the Settlement Class Member believes is fairly traceable to the Data Breach and/or 2) taking preventative measures to avoid such losses, then you can submit a claim for reimbursement. Lost Time will be paid at the Reimbursement Rate, which shall be $25 per hour, and can be made in 15-minute increments.

Lost Time related to Out-of-Pocket Losses. Lost Time related to a qualifying claim for Out-of-Pocket Losses may be supported by a certification for up to 10 hours. If the Settlement Administrator does not approve your claim for Out-of-Pocket Losses, related claims for Lost Time will be treated as a claim for Self-Certified Lost Time.

Self-Certified Lost Time. Settlement Class Members who attest (i) to fraud, identity theft, or other alleged misuse of the Settlement Class Member’s personal information the Settlement Class Member believes is fairly traceable to the Data Breach, or taking preventive measures to avoid such fraud, identity theft, or other misuse and (ii) that they spent time remedying such misuse or taking such preventative measures, may self-certify the amount of time they spent remedying the foregoing by providing a certified explanation of the misuse or preventative measures taken and how the time claimed was spent remedying the misuse or taking preventative measures. Settlement Class Members may file a claim for Self-Certified Lost Time for up to 5 hours at the Reimbursement Rate.

The deadline to file a claim for Lost Time is March 30, 2026.

Settlement Benefit: Alternative Cash Payments: Instead of making a claim for Lost Time and Out of Pocket Losses, Settlement Class Members (except California Settlement Subclass Members) may request an Alternative Cash Payment in the estimated amount of $50, subject to the pro rata adjustments.

California Settlement Subclass Members may request an Alternative Cash Payment in the estimated amount of $150, subject to the pro rata adjustments, in lieu of making claims for Lost Time and Out of Pocket Losses. To receive a California Subclass Payment, California Settlement Subclass Members must submit a Claim Form and attest they were a California resident on March 29, 2023, and include the residential address where they resided on that date.

Settlement Class Members making a claim for Lost Time will be entitled to the greater of the approved claim for Lost Time, or the amount available under the Alternative Cash provision.

The timing of the pro rata adjustment calculations will be made immediately after the processing of all claims and the Settlement Administrator will issue payments based upon such pro rata adjustment calculations as soon as practicable.

The deadline to file a claim for Alternative Cash Payments is March 30, 2026.

Settlement Benefit: Identity Defense Services and Restoration Services: All Settlement Class Members are entitled to enroll in Identity Defense Services and Restoration Services as a benefit of the Settlement, in addition to claiming Out-of-Pocket Losses and Lost Time, or Alternative Cash Payment. This service will be active for three years after the Effective Date of the Settlement,  March 20, 2026.

If you are the Parent of a Minor who is a Class Member, you may enroll your Minor in Identity Defense Services. There is no deadline to enroll for free Identity Defense Services, but service will end on the same date regardless of when you enroll. Restoration Services are also available to Settlement Class Members during the service period, and you may take advantage of those services regardless of whether you made a claim or enrolled in Identity Defense Services.

How to Activate Your Identity Defense Services

1. You must activate your identity monitoring services by March 20, 2029. Your Activation Code will not work after this date.
2. Visit enroll.krollmonitoring.com/redeem to activate your identity monitoring services.
3. Provide Your Activation Code: <<Activation Code>> and Your Verification ID: <<Verification ID>>.

ENROLL HERE

Services Provided by Kroll

Triple Bureau Credit Monitoring and Single Bureau Credit Report

Your current credit report is available for you to review. You will also receive alerts when there are changes to your credit data at any of the three national credit bureaus, for instance, when a new line of credit is applied for in your name. If you do not recognize the activity, you’ll have the option to call a Kroll fraud specialist, who can help you determine if it’s an indicator of identity theft. To receive credit services, you must be over the age of 18 and have established credit in the U.S., have a Social Security number in your name, and have a U.S. residential address associated with your credit file.

Dark Web Monitoring

Dark Web Monitoring monitors internet sites where criminals may buy, sell, and trade personal identity information. An alert will be generated if evidence of your personal identity information is found.

Social Security Number Scan

Social Security Number Scan monitors and notifies when names, aliases, and addresses become associated with your Social Security number. If information is found, you will receive an alert.

Pay Day Loan Monitoring

Pay Day Loan Monitoring monitors short-term and cash-advance loan sources. You will receive an alert when a loan is reported,and you can call a Kroll fraud specialist for more information.

$1 Million Identity Fraud Loss Reimbursement

Reimburses you for out-of-pocket expenses totaling up to $1 million in covered legal costs and expenses for any one stolen identity event. All coverage is subject to the conditions and exclusions in the policy.

Fraud Consultation

You have unlimited access to consultation with a Kroll fraud specialist. Support includes showing you the most effective ways to protect your identity, explaining your rights and protections under the law, assistance with fraud alerts, and interpreting how personal information is accessed and used, including investigating suspicious activity that could be tied to an identity theft event.

Identity Theft Restoration

If you become a victim of identity theft, an experienced Kroll licensed investigator will work on your behalf to resolve related issues. You will have access to a dedicated investigator who understands your issues and can do most of the work for you. Your investigator can dig deep to uncover the scope of the identity theft and then work to resolve it.

Should you have any questions about Identity Defense Services, please contact [email protected], available 7:00 am to 7:00 pm CT, Monday through Friday.

The Settlement Fund will be used to pay claims for (i) Notice Costs; (ii) Administrative Costs; (iii) Service Awards approved by the Court; (iv) Attorneys’ Fees and Expenses approved by the Court; and (v) Settlement benefits for the Settlement Class, including Identity Defense Services and Restoration Services.

• To the extent total valid claims are less than the Net Settlement Fund, all valid claims for Time Spent and Alternative Cash Payments shall be increased on a pro rata basis, up to a maximum amount of $599.
• To the extent that the total valid claims are less than the Net Settlement Fund after the pro rata increases for claims for Time Spent and Alternative Cash Payments, the remaining funds shall be used to extend the length of the Identity Defense Services. No funds shall revert to NextGen. Any remaining Settlement Funds and/or uncashed checks will be used to extend the monitoring period (if practicable) and/or will be subject to cy pres distribution to a non-profit cybersecurity organization to be negotiated by the Parties and approved by the Court, but no money will be returned to NextGen.

If the total number of valid claims exceeds the Settlement Fund, all valid claims (including Alternative Cash Payments) will be reduced on a pro rata basis.

To file a claim for reimbursement for Alternative Cash Payment, Out-of-Pocket Losses, or Lost Time, you will need to file a Claim Form. The easiest way to submit a Claim Form is online, by filling out the form on this Settlement Website You can also download a paper Claim Form and return a completed Claim Form by mail, or if you are submitting an Alternative Cash Payment claim, tear-off the form from your post-card notice and mail it in.

The deadline to file a claim for Out-of-Pocket Losses or Lost Time fairly traceable to the Data Breach is March 30, 2026 (this is the last day to file online and the postmark deadline for mailed claims). Mailed claims must be post-marked by March 30, 2026. Claims submitted electronically must be submitted by 11:59 PM PT on March 30, 2026. 

Additional information regarding these services and enrollment directions will be available on this Settlement Website. The Services will be available for a three-year period starting no earlier than March 20, 2026, or whatever date on which the Settlement becomes final. You may later enroll in Identity Defense Services at any time the service is active, however all memberships in the free Identity Defense Services will end on the same date regardless of when you enroll, three years after the Effective Date of the Settlement.

Identity Defense Services claimed by Settlement Class Members will begin, and payments for valid claims for Out-of-Pocket Losses, Lost Time and/or Alternative Cash Payments will be made, after the Court enters a Final Approval Order and Judgment and the Settlement becomes final. This may take several months or more; please be patient. Periodic updates will be posted on this Settlement Website.

The notice sent by the Settlement Administrator contained an Activation Code and Verification ID that will be used to enroll for Identity Defense Services. The Service will become active once the Settlement is final, March 20, 2026, but you will need to enroll.

Payments for valid claims for Out-of-Pocket Losses, Lost time and/or Alternative Cash Payments will be made by the Settlement Admins in the manner you select (various digital payment options or a paper check).

If you make a claim under the Settlement, or if you do nothing, you will be releasing all of your legal claims relating to the Data Breach against Defendant when the Settlement becomes final. By releasing your legal claims, you are giving up the right to file, or to continue to pursue, separate legal claims against or seek further compensation from Defendant for any harm related to the Data Breach or the claims alleged in the lawsuits— whether or not you are currently aware of those claims.

Unless you exclude yourself from the Settlement (see Question 17), all of the decisions by the Court will bind you. That means you will be bound to the terms of the Settlement and accompanying court orders and cannot bring a lawsuit or be part of another lawsuit against Defendant regarding the Data Breach.

Paragraph 2.30 of the Settlement Agreement defines the claims that will be released by Settlement Class Members who do not exclude themselves from the Settlement. You can access the Settlement Agreement and read the specific details of the legal claims being released on this Settlement Website.

If you have any questions, you can contact the Settlement Administrator (see Question 19).

Yes. The Court appointed the following attorneys to represent you and other Settlement Class Members as “Class Counsel.”

You will not be charged by these lawyers for their work on the case. If you want to be represented by your own lawyer, you may hire one at your own expense.

If you have questions about making a claim, please contact the Settlement Administrator (see Question 19).

Class Counsel have undertaken this case on a contingency-fee basis, meaning they have paid for all of the Expenses in the case and have not been paid any money in relation to their work on this case. Accordingly, Class Counsel will ask the Court to award them Attorneys’ Fees and Expenses of up to one-third of the Settlement Fund and reimbursement for costs and Expenses to be paid from the Settlement Fund. The Court will decide the amount of fees and costs and Expenses to be paid. You will not have to separately pay any portion of these fees yourself. Class Counsel’s request for Attorneys’ Fees and Expenses (which must be approved by the Court) will be filed by January 22, 2026 and will be available to view in the Documents section of this Settlement Website.

The Settlement Class Representatives in this Action are listed in the Settlement Agreement, which is available in the Documents section of this Settlement Website. Class Counsel will ask the Court to award the Settlement Class Representatives Service Awards of up to $2,500 each for the time that they spent, and the risks that they undertook, in bringing this lawsuit on behalf of the Class. This amount will have to be approved by the Court. Any amount approved by the Court will be paid from the Settlement Fund. If the Court awards less than Class Counsel’s request in Service Awards or Attorneys’ Fees and Expenses, the difference will remain in the Settlement Fund to be used for the benefit of the Settlement Class Members.

Class Counsel’s request for Attorneys’ Fees and Expenses (which must be approved by the Court) will be filed no later than twenty-one (21) days before the Objection Deadline and will be available to view in the Documents section of this Settlement Website.

If you are a Settlement Class Member but do not want to remain in the Settlement Class, you may exclude yourself from the Settlement Class (also known as “opting out”). If you exclude yourself, you will lose any right to participate in the Settlement, including any right to receive the benefits outlined in this notice.

If you decide on this option, you will keep any rights you have, if any, against Defendant and you may file your own lawsuit against Defendant based upon the same legal claims that are asserted in this lawsuit, but you will need to find your own attorney at your own cost to represent you in that lawsuit. If you are considering this option, you may want to consult an attorney to determine your options.

IMPORTANT: You will be bound by the terms of the Settlement Agreement unless you submit a timely and signed written request for exclusion from the Settlement. To exclude yourself from the Settlement, you must either: submit the request online on the Settlement Website (and verified via your email), or mail a request for exclusion, postmarked no later than February 12, 2026, to:

NGH Data Breach Litigation
Attn: Exclusion
c/o Kroll Settlement Administration LLC
P.O. Box 5324
New York, NY 10150-5391

To exclude yourself from the Settlement online, you must utilize the Request for Exclusion form on the Settlement Website which must be submitted (and verified via your email) by 11:59 p.m. PT on February 12, 2026.

The opt-out statement must contain the following information:

(1) Identify the case name and number of the Action;
(2) Identify the name and address of the individual seeking exclusion from the Settlement;
(3) Be personally signed by the individual seeking exclusion (or by the legal representative of a minor child with authority to so act); 
(4) Include a statement clearly indicating the individual’s intent to be excluded (or to exclude the minor) from the Settlement; and
(5) Request exclusion only for that one individual identified by the request.

If you do not comply with these procedures and the deadline for exclusions, you will lose any opportunity to exclude yourself from the Settlement Class, and your rights will be determined in this lawsuit by the Settlement Agreement if it is approved by the Court.

If you are a Settlement Class Member, you have the right to tell the Court what you think of the Settlement. You can object to the Settlement if you don’t think it is fair, reasonable, or adequate, and you can give reasons why you think the Court should not approve it. You can’t ask the Court to order a larger Settlement; the Court can only approve or deny the Settlement as it is.

To object, you must send a written objection identifying you as a Settlement Class Member stating that you object to the Settlement. Your objection must include:

1. The case name and number of the Action;
2. The name, address, and telephone number of the objecting Settlement Class Member and, if represented by counsel, of his/her counsel;
3. A statement of whether the objection applies only to the objector, to a specific subset of the class, or to the entire class; 
4. A statement of the number of times in which the objector (and, where applicable, objector’s counsel) has objected to a class action settlement within the three years preceding the date that the objector files the objection, along with the caption of each case in which the objector has made such objection;
5. Information identifying the objector as a Settlement Class Member, including proof that the objector is a Member of the Settlement Class (e.g., copy of the objector’s Settlement notice, copy of original notice of the Data Breach, or a statement explaining why the objector believes he or she is a Settlement Class Member); 
6. A statement of the specific grounds for the objection, including any evidence or legal authority the Settlement Class Member wishes to bring to the Court’s attention; 
7. Be personally signed by the individual seeking to object (or by the legal representative of a minor child with authority to so act); and
8. A statement of whether the objecting Settlement Class Member intends to appear at the Final Approval Hearing, and if so, whether personally or through counsel.

Additionally, if you are represented by a lawyer and your lawyer intends to speak at the Final Approval Hearing, your written objection must include:

9. A detailed description of any evidence you may offer at the Final Approval Hearing; and
10. Copies of any exhibits you may introduce at the Final Approval Hearing.

To be considered by the Court, your written objection must be filed with the Court by February 12, 2026, or mailed, postmarked no later than February 12, 2026, to the following address:

NGH Data Breach Litigation 
c/o Kroll Settlement Administration LLC
PO Box 5324
New York, NY 10150-5391

If you do not comply with these procedures and the deadline for objections, you may lose any opportunity to have your objection considered at the Final Approval Hearing or otherwise to contest the approval of the Settlement or to appeal from any orders or judgments entered by the Court in connection with the proposed Settlement. You will still be eligible to receive Settlement benefits if the Settlement becomes final even if you object to the Settlement.

The Court has scheduled a Final Approval Hearing to listen to and consider any concerns or objections from Settlement Class Members regarding the fairness, adequacy, and reasonableness of the terms of the Settlement Agreement. That hearing is currently scheduled to take place on February 17, 2026, at 10:00 AM ET, before the Honorable Thomas W. Thrash, Jr., at the United States District Court Northern District of Georgia (Atlanta Division) located in Courtroom 2108 of the Richard B. Russell Federal Building & United States Courthouse, 2211 United States Courthouse, 75 Ted Turner Drive, SW, Atlanta, GA 30303-3309. This hearing date and time may be moved. Please refer to this Settlement Website for notice of any changes.

If you have questions about this notice or the Settlement or to update your address, you may complete the Contact Us form on this Settlement Website. You can also contact the Settlement Administrator at 833-630-5369 or by mailing a letter to NGH Data Breach Litigation, c/o Kroll Settlement Administration LLC, P.O. Box 5324, New York, NY 10150-5391 for more information or to request that a copy of this document be sent to you in the mail. If you wish to communicate directly with Class Counsel, you may contact them (contact information noted above in Question 14). You may also seek advice and guidance from your own private lawyer at your own expense, if you wish to do so.

This Settlement Website is only a summary of the lawsuit and the Settlement. Other related documents can be accessed through the Documents section of this Settlement Website. If you have questions about the proposed Settlement, or wish to receive a copy of the Settlement Agreement but do not have access to the Internet to download a copy online, you may contact the Settlement Administrator. The Court cannot respond to any questions regarding the notice, the lawsuit, or the proposed Settlement.