Metabase and Blueberry Medical Face Class Action Lawsuit

The suit alleges the companies failed to protect sensitive patient records and delayed notifying individuals of a breach.

Updated on Oct. 21, 2026 in Cybersecurity

Metabase and Blueberry Medical Face Class Action Lawsuit

Live Poll

Should companies face legal penalties for delaying patient notifications after a data breach?

Metabase Inc. and Blueberry Medical are facing a proposed class action lawsuit in California federal court. The complaint alleges that the companies failed to protect sensitive patient health information and delayed notifying those affected by a recent cybersecurity attack.

Why it matters

The litigation highlights growing legal scrutiny regarding data security standards and the timeliness of disclosure in healthcare IT. It emphasizes the risks firms face when failing to secure patient records or communicate breaches promptly.

The litigation centers on allegations of negligence regarding the handling of personal health information. The specific technical safeguards, if any, that were bypassed during the breach have not been detailed in the court filing.

The players

Metabase Inc.

A healthcare technology provider that manages patient information and health records.

Blueberry Medical

A medical services firm and co-defendant in the class action lawsuit.

The details

Plaintiffs filed the proposed class action in federal court alleging that the defendants failed to implement adequate security measures to shield patient data. The complaint claims that beyond the initial security failure, the organizations compromised patient safety further by waiting several weeks before notifying those impacted. This delay in disclosure is central to the negligence claims brought by the plaintiffs.

October 19, 2026: The proposed class action lawsuit was filed.

The Tech Race

This case follows a documented trend of litigation following the 2015 Anthem data breach, where healthcare entities face significant legal pressure for data mismanagement. It marks another instance of plaintiffs challenging how quickly companies act to inform patients after a cyber attack.

California patients who have interacted with Metabase Inc. or Blueberry Medical should watch for future notifications regarding the scope of exposed information. Affected individuals may eventually be included in the proposed class if the court certifies the lawsuit.

The takeaway

This case serves as a reminder to monitor communications from healthcare providers regarding data security. Track the federal court docket for developments in the class certification process, which will determine how many individuals are eligible for potential damages.