Apex Global Solutions, a revenue-cycle manager for skilled nursing and long-term care facilities, agreed to settle a class action after a cybersecurity incident between June 18 and July 2, 2024 exposed personal and protected health information for about 390,000 current and former patients. Plaintiffs allege the company failed to protect names, addresses, dates of birth, Social Security and driver’s license numbers, financial account details and health information; the proposed settlement offers class members up to $3,500 for documented out‑of‑pocket losses plus three years of medical data monitoring, identity-theft insurance and other services, with claims due by May 13, 2026. Apex denies wrongdoing but settled to avoid prolonged litigation and uncertainty, and approved payouts and monitoring will be distributed after final court approval. This case matters beyond individual payouts because it underscores how vendors that handle billing and records for health care providers are prime targets and may be treated as HIPAA business associates with legal duties to safeguard protected health information and to notify affected parties and regulators. Vendor-related breaches have prompted similar class actions and settlements in recent years, and outcomes like this tend to increase regulatory scrutiny (including OCR enforcement), contractual demands for stronger cybersecurity controls and broader use of cyber insurance and monitoring services across the health-care ecosystem. For patients, settlements provide financial and monitoring relief; for the industry, they reinforce the need for tighter technical, administrative and contractual safeguards to protect sensitive medical data.