EHR & Health Data Systems · EHR Vendor (Ambulatory/Practice) · Regulatory action + Private litigation + Data breach
NextGen Healthcare
Headline
Two separate problems. First, in July 2023 NextGen agreed to pay $31 million to settle False Claims Act allegations.
Not independently verified. Verification status: Unverified - heuristic first draft. Publish state: draft unverified.
Two separate problems. First, in July 2023 NextGen agreed to pay $31 million to settle False Claims Act allegations. DOJ alleged that it got 2014 Edition certification using a separate product built only to run the test scripts, hiding that the released software could not do required things such as record vital signs, translate data into required medical vocabularies, or produce complete clinical summaries. DOJ also alleged that NextGen gave customers referral credits 'often worth as much as $10,000' plus event tickets. Second, hackers were inside the NextGen Office system from March 29 to April 14, 2023 and took the personal data (name, date of birth, address, Social Security number) of about 1.05 million patients, after an earlier BlackCat ransomware intrusion in January 2023. NextGen said it saw no evidence that health records were accessed. The consolidated class action in N.D. Ga. settled for $19.375 million, and the settlement received final approval (reported February 2026). NextGen denied wrongdoing.
- Severity
- Evidence tierUnassigned
- Claims confirmed
- Last verified2026-10-15
Primary source. www.justice.gov/archives/opa/pr/electronic-health-records-vendor-nextgen-healthcare-inc-pay-31-million-settle-false-claims — Unverified - heuristic first draft.
Terms
Arbitration
No arbitration clause or class action waiver in NextGen's website Legal Notices (dated Sept 22, 2026), which choose Delaware law and Delaware (New Castle County) courts. Customer (practice) agreements are not public, so contract-level dispute terms remain unknown.
Data sharing
The privacy policy (effective Jan 1, 2026) says NextGen does not sell personal information 'for monetary consideration' but uses 'third-party cookies for website analytics and targeted advertising purposes' and processes personal information 'for the purposes of targeted advertising'. Cookie-banner opt-out is available. The policy expressly does not cover PHI handled through the NextGen Patient Portal; patients are directed to their provider.
Fees and billing
DOJ alleged referral credits to existing customers 'often worth as much as $10,000'. NextGen's certification cost-disclosure page lists fee types but no dollar amounts: NextGen Office is priced per provider; lab and immunization-registry interfaces carry a software license fee, an implementation fee and a recurring maintenance/support fee; data migration and third-party HL7 integrations may cost extra. Actual prices are contract-specific.
Contacts
Privacy contact. privacy@nextgen.com
Legal notice. NextGen Healthcare, Inc., Attn: Privacy and Security, 18111 Von Karman Ave., Suite 600, Irvine, CA 92612. This is the address printed in the vendor's privacy notice, which is not necessarily the registered agent for service of process. For formal legal notice, check the notice clause in the practice's signed customer agreement and the Secretary of State registered-agent record in the state of incorporation.
Mailing address. Not recorded.
Evidence
No claims have been itemized for this row yet.
Sources
| Source | Claim | Tier | Status | Quote |
|---|---|---|---|---|
| Federal agency press release (DOJ) · 2023-07-14 www.justice.gov/archives/opa/pr/electronic-health-records-vendor-nextgen-healthcare-inc-pay-31-million-settle-false-claims | whole row | Unassigned | confirmed | “concealed from the certifying entity that NextGen's EHR lacked critical functionality” Quote basis: not recorded. |
| SEC filing (Form 10-K FY2023) · 2023-05 www.sec.gov/Archives/edgar/data/708818/000095017023023499/nxgn-20230331.htm | whole row | Unassigned | confirmed | “certain personal information belonging to approximately 1 million patients” Quote basis: not recorded. |
| Trade press · 2025-10-29 www.hipaajournal.com/nextgen-class-action-data-breach-lawsuit-proceeds/ | whole row | Unassigned | confirmed | “NextGen Healthcare denies all claims and contentions in the lawsuit” Quote basis: not recorded. |
| Legal press · 2026-02-18 news.bloomberglaw.com/litigation/nextgen-healthcare-wins-nod-for-19-million-data-breach-pact | whole row | Unassigned | confirmed | “received final approval from a federal court” Quote basis: not recorded. |
| Company press release · 2023-11-10 www.thomabravo.com/press-releases/thoma-bravo-completes-acquisition-of-nextgen-healthcare | whole row | Unassigned | confirmed | “has ceased trading and will be delisted from Nasdaq” Quote basis: not recorded. |
| Company privacy policy · 2026-01-01 www.nextgen.com/privacy-policy | whole row | Unassigned | confirmed | “we do use third-party cookies for website analytics and targeted advertising purposes” Quote basis: not recorded. |
Source vault
Link status: Candidate - not yet fetched
| Document | Last fetch | |
|---|---|---|
| Privacy policy https://www.nextgen.com/privacy-policy | Not fetched yet | NOT CONFIRMED |
| Terms of service No URL recorded | Not fetched yet | NOT CONFIRMED |
| Website https://www.nextgen.com/ | Not fetched yet | — |
| Primary source https://www.justice.gov/archives/opa/pr/electronic-health-records-vendor-nextgen-healthcare-inc-pay-31-million-settle-false-claims Verification: Unverified - heuristic first draft | Not fetched yet | — |
Enforcement
| Action | Amount | Link |
|---|---|---|
| United States ex rel. Markowitz v. NextGen Healthcare ($31M EHR settlement) U.S. Department of Justice (Civil Division), U.S. Attorney's Office, District of Vermont, 2023 DOJ Press Release No. 23-764 (July 14, 2023); No. 2:18-cv-195 (D. Vt.) | $31M | proposed |
Links are proposed matches, not yet reviewed.
State statute
Headquarters on file: CA. Provisions of CCPA/CPRA on file:
| Provision | Type | Source |
|---|---|---|
| Right to Deletion Cal. Civ. Code § 1798.105 | hard | source |
| Right to Correction Cal. Civ. Code § 1798.106 | hard | source |
| Right to Know / Access Cal. Civ. Code § 1798.110 | hard | source |
| Right to Limit Use of Sensitive Personal Information Cal. Civ. Code § 1798.121; Cal. Code Regs. tit. 11, § 7027 | hard | source |
| Right to Data Portability Cal. Civ. Code § 1798.130(a)(3)(B)(iii) | hard | source |
| Privacy Policy / Privacy Notice Requirements Cal. Civ. Code § 1798.130(a)(5); Cal. Code Regs. tit. 11, § 7011 | hard | source |
| Sensitive Personal Information — Categories Cal. Civ. Code § 1798.140(ae) | hard | source |
| Service Provider and Contractor Contract Requirements Cal. Civ. Code § 1798.140(ag); Cal. Code Regs. tit. 11, § 7051 | hard | source |
| Applicability Threshold (2025 CPI-Adjusted) Cal. Civ. Code § 1798.140(d) | threshold | source |
| Privacy Risk Assessment — Mandatory for High-Risk Processing (Eff. Jan. 1, 2026) Cal. Civ. Code § 1798.185(a)(15); Cal. Code Regs. tit. 11, §§ 7150-7157 | hard | source |
| Right to Opt Out of Sale or Sharing Cal. Civ. Code §§ 1798.120, 1798.135 | hard | source |
| Sale vs. Sharing Distinction Cal. Civ. Code §§ 1798.140(ad), 1798.140(ah) | hard | source |
| Enforcement — CPPA and AG; Civil Penalties (2025 CPI-Adjusted) Cal. Civ. Code §§ 1798.155, 1798.199.90; Cal. Bus. & Prof. Code § 17206 | hard | source |
| Notice at Collection Cal. Code Regs. tit. 11, § 7012 | hard | source |
| Cybersecurity Audit — Annual Independent Audit Requirement (Eff. Jan. 1, 2026) Cal. Code Regs. tit. 11, §§ 7120-7124 | hard | source |
| Automated Decision-Making Technology (ADMT) — Notice, Opt-Out, and Access Rights Cal. Code Regs. tit. 11, §§ 7200-7222; Cal. Civ. Code § 1798.185(a)(16) | hard | source |