Serviceaide, Inc., a provider of AI-powered solutions to boost productivity and enhance service delivery, has agreed to pay $1.8 million to settle a lawsuit stemming from a 2024 data breach that exposed the protected health information of patients of its client, Catholic Health.

Catholic Health is a Buffalo, NY-based non-profit healthcare system serving patients in Western New York through its hospitals, nursing homes, home care agencies, and physician practices. Catholic Health contracted with Serviceaide, and the provision of the contracted services required access to patient data. On or around November 15, 2024, Serviceaide identified unauthorized access to its systems. The forensic investigation confirmed that an unauthorized third party had access to its network from September 19, 2024, to November 5, 2024.

Servieaide determined that a database containing the records of approximately 483,000 Catholic Health patients was potentially accessed or obtained. The database contained names, dates of birth, Social Security numbers, medical/health information, treatment information, health insurance information, and email/usernames and accompanying passwords. The affected individuals were notified about the data breach on May 9, 2025.

Eleven class action lawsuits were filed in response to the data breach, which were consolidated – Nancy Balzer, et al., v. Serviceaide, Inc. – in the Supreme Court of the State of New York, County of Nassau. The consolidated lawsuit alleges that the data breach should have been prevented and was the result of negligence on the part of the defendant. The lawsuit asserted claims for negligence, breach of implied contract, unjust enrichment, invasion of privacy, violations of California’s Unfair Competition Law, Cal. Bus. & Prof. Code §§ 17200, et seq., and declaratory judgment.

Serviceaide denies all wrongdoing, and disagrees with all claims and contentions in the lawsuit. The defendant filed a motion to dismiss, and the plaintiffs filed their opposition to the motion. To conserve resources for the benefit of the class members, the parties explored a potential settlement. As a result of hard-fought negotiations, the terms of a settlement were agreed, and the settlement has now been finalized.

Under the terms of the settlement, Serviceaide has agreed to establish a $1,800,000 settlement fund, from which attorneys’ fees and expenses, settlement administration and notification costs, and service awards for the 15 class representatives will be deducted. The remainder of the fund will be used to pay valid claims from the class members.

Class members may claim one of two cash payments. They may submit a claim for reimbursement of documented, unreimbursed losses due to fraud or identity theft as a result of the incident, and other losses up to a maximum of $5,000 per class member. Alternatively, a claim may be submitted for a cash payment, estimated to be approximately $50 per claim. The cash payments will be paid pro rata after the claims for losses have been paid. The deadline for submitting a claim is September 1, 2026. The final fairness hearing has been scheduled for September 16, 2026. The deadline for objection and opting out is August 17, 2026.

The post Serviceaide Pays $1.8 Million to Settle Data Breach Litigation appeared first on The HIPAA Journal.