Conduent Agrees to $80 Million Class-Action Settlement Over 62.2 Million-Record Healthcare Data Breach

An $80 million civil settlement is now the price tag attached to what published reporting describes as the third-largest healthcare data breach on record, and it came not from a government regulator but from a federal class-action lawsuit.

Conduent, a business services provider that handles data processing and administrative functions for healthcare organizations, agreed to pay $80 million to resolve class-action litigation connected to a breach reported at roughly 62.2 million records. The settlement agreement was signed October 16, 2026, and publicly reported October 27, 2026. It was filed in the U.S. District Court for the District of New Jersey.

Why the Scale of This Settlement Matters

Eighty million dollars is a number compliance officers and risk managers should write down somewhere visible. It represents what civil plaintiffs were able to extract from a single business associate through litigation alone, before any potential regulatory action. For organizations that rely on third-party vendors to process, store, or transmit protected health information, this settlement is a direct data point on the financial exposure those relationships carry.

Reported at roughly 62.2 million affected individuals, the Conduent breach sits in rare territory. Very few healthcare data incidents have reached that scale. The sheer number of people involved drove the breadth of the class, and that breadth drove the settlement value.

What HIPAA Requires of Business Associates

Conduent operated as a business associate under HIPAA, meaning it handled protected health information on behalf of covered entities. Business associates carry the same core security obligations as the covered entities they serve.

Those obligations include implementing administrative safeguards such as risk analysis and risk management programs under 45 CFR §164.308, physical safeguards governing facility and workstation access under 45 CFR §164.310, and technical safeguards controlling access to electronic protected health information under 45 CFR §164.312.

When a business associate experiences a breach, covered entities also face their own notification obligations. The breach notification rule under 45 CFR §164.400 requires covered entities to notify affected individuals, the Secretary of HHS, and in some cases the media, depending on the number of people affected in a given state.

The Vendor Risk Blind Spot

Many healthcare organizations treat vendor risk management as a checkbox exercise: collect a signed business associate agreement, file it, and move on. The Conduent settlement illustrates why that approach is insufficient.

A business associate agreement is a legal prerequisite under 45 CFR §164.502, but it is not a risk control. It allocates legal responsibility; it does not prevent breaches or contain their consequences. When a vendor processes data at the scale Conduent did, and a security failure occurs, the affected individuals sue, the litigation is expensive, and settlements of this magnitude become possible.

Covered entities that did business with Conduent had protected health information belonging to their patients in Conduent's environment. The reputational and operational fallout from a breach of that scale extends well beyond the vendor itself.

Practical Implications for Compliance Programs

For compliance officers and healthcare SaaS founders assessing their own vendor ecosystems, a few questions are worth asking now rather than after an incident:

What is the aggregate record volume held by your largest vendors? If a single vendor processes data on millions of your patients, the exposure from a breach at that vendor is proportional to that volume.

How are your BAAs structured around breach response? A business associate agreement should include clear timelines and notification requirements that align with, or exceed, the 60-day notification window under 45 CFR §164.412.

Are you conducting ongoing vendor security reviews? The HIPAA Security Rule does not specify how often organizations must reassess vendors, but a risk-based approach under 45 CFR §164.308 implies that high-volume, high-risk vendors warrant more frequent scrutiny.

Do you have cyber liability coverage that accounts for third-party breach scenarios? If your vendor is breached and your patients are affected, your organization may still face costs, regulatory inquiries, and reputational damage even if the primary litigation targets the vendor.

What This Settlement Does Not Tell Us

Published reporting on the settlement does not detail the specific security failures that led to the underlying breach. MedComply.ai covered the breach disclosure and its scale in earlier reporting, and this settlement represents a legal follow-on development rather than new information about the incident's technical cause.

It is also worth noting that an $80 million class-action settlement does not resolve potential regulatory exposure. OCR enforcement and state attorney general investigations can proceed independently of civil litigation. No regulatory action against Conduent has been announced at this time, and this article does not speculate on whether one will follow.