Life-Health-Dental Insurance · Health Insurance · Private litigation + Data breach
Cigna Healthcare
Headline
A class action alleges that over a two-month stretch in 2022, Cigna medical directors used a system called PXDX to deny more than 300,000 claims at an average of 1.2 seconds of review each - and a former Cigna…
Not independently verified. Verification status: Unverified - heuristic first draft. Publish state: draft unverified.
A class action alleges that over a two-month stretch in 2022, Cigna medical directors used a system called PXDX to deny more than 300,000 claims at an average of 1.2 seconds of review each - and a former Cigna physician told ProPublica the process amounted to clicking submit on batches of fifty at a time, taking about ten seconds. The legal theory is precise rather than rhetorical: California law requires a medical-necessity denial to be reviewed by a licensed physician competent to evaluate the specific clinical issue, and the plaintiffs argue a 1.2-second rubber stamp is not a review, which would also breach the plan's own terms requiring a medical director to make the call. Cigna's defense is that PXDX is not AI at all but simple sorting technology that matches procedure codes to diagnosis codes, similar to systems CMS itself uses, and that the vast majority of claims routed through it were paid automatically. A judge let the case proceed in March 2025.
- Severity
- Evidence tierUnassigned
- Claims confirmed
- Last verified2026-08-04
Case status. Private litigation; no sources are on file yet, so no legal tier is assigned.
Primary source. None recorded — Unverified - heuristic first draft.
Terms
Arbitration
Not independently confirmed this pass — standard binding arbitration + class action waiver expected.
Data sharing
CONFIRMED THIRD-PARTY VENDOR BREACH (disclosed Dec 2025, affecting a Massachusetts Mutual Life Insurance Company benefit plan Cigna administers): a Cigna vendor's incident — occurring October 21, 2024 to January 13, 2025; the vendor first notified Cigna on January 15, 2025, confirmed Cigna data was involved on September 3, 2025, and affected individuals were identified September 23-29, 2025 (notice letters dated December 11, 2025) — exposed CLAIM OVERPAYMENT AND RECOVERY FILES, with Social Security numbers included for some individuals. The notice states the vendor 'is unaware of any attempted or actual misuse of any information.' SEPARATELY, a class action reported on Jan 5, 2026 accuses Cigna of failing to secure patient claims information (names, health care IDs, dates of service, treatment costs, claim numbers) exposed when an unauthorized actor accessed one of Cigna's vendors — whether this is the same vendor incident described above was not confirmed.
Fees and billing
Not itemized this pass.
Contacts
Privacy contact. Not recorded.
Legal notice. PUBLIC COMPANY (CI). Service route: c/o General Counsel / Corporate Secretary, Bloomfield, Connecticut — the corporate address on the SEC Form 10-K cover page is the official address of record. Confirm the exact street address on the current 10-K at sec.gov/edgar, and check the state-of-incorporation registered agent (usually Delaware; most large filers use The Corporation Trust Company or Corporation Service Company) via the Secretary of State business-entity search. A registered agent MUST accept service, which is why it is the reliable channel when a company publishes no privacy address.
Mailing address. Not recorded.
Evidence
No claims have been itemized for this row yet.
No sources are on file for this row yet.
Source vault
Link status: Candidate - not yet fetched
| Document | Last fetch | |
|---|---|---|
| Privacy policy cigna.com/legal/privacy | Not fetched yet | NO (HTML only) |
| Terms of service cigna.com/legal/terms-of-use | Not fetched yet | NO (HTML only) |
| Website thecignagroup.com | Not fetched yet | — |
| Primary source No URL recorded Verification: Unverified - heuristic first draft | Not fetched yet | — |
Enforcement
No enforcement actions are linked to this row.
State statute
Headquarters on file: Connecticut. Provisions of CTDPA on file:
| Provision | Type | Source |
|---|---|---|
| Sensitive Data — Opt-In Consent Required Conn. Gen. Stat. § 42-515(38); § 42-520(a)(4) | hard | source |
| Applicability Threshold Conn. Gen. Stat. § 42-516 | threshold | source |
| Universal Opt-Out Mechanism — GPC Recognition Required Conn. Gen. Stat. § 42-518 | hard | source |
| Right to Access Conn. Gen. Stat. § 42-518(a)(1) | hard | source |
| Right to Correction Conn. Gen. Stat. § 42-518(a)(2) | hard | source |
| Right to Deletion Conn. Gen. Stat. § 42-518(a)(3) | hard | source |
| Right to Data Portability Conn. Gen. Stat. § 42-518(a)(4) | hard | source |
| Right to Opt Out of Sale, Targeted Advertising, and Profiling Conn. Gen. Stat. § 42-518(a)(5) | hard | source |
| Right to Appeal Denied Request Conn. Gen. Stat. § 42-518(c) | hard | source |
| Privacy Notice Requirements Conn. Gen. Stat. § 42-520(c) | hard | source |
| Privacy Notice — Personal Data Used to Train Large Language Models Conn. Gen. Stat. § 42-520, as amended by 2025 Conn. Pub. Acts 25-113 (SB 1295, enacted June 24, 2025; July 1, 2026 effective date and the LLM-training notice requirement confirmed via Hunton Andrews Kurth summary; subsection pinpoint not verified against the Public Act text) | hard | source |
| Processor Contract Requirements Conn. Gen. Stat. § 42-521 | hard | source |
| Automated Decision-Making Technology — Impact Assessment Conn. Gen. Stat. § 42-522, as amended by 2025 Conn. Pub. Acts 25-113 | hard | source |
| Enforcement — AG Only; Civil Penalties Conn. Gen. Stat. § 42-525 | hard | source |
| Teen Protections — Ages 13 to 15 Conn. Gen. Stat. §§ 42-515 et seq. (2023 amendments) | hard | source |
| ADMT Disclosure — LLM Training Data and Profiling Contest Right (Eff. July 1, 2026) Conn. Gen. Stat. §§ 42-518(a)(6), 42-520(b)(1)(H), 42-522(c) (as amended by P.A. 25-113, eff. July 1, 2026) | hard | source |