Data Breach Lawsuits Settled by Omni Healthcare & Western Montana Clinic

Posted by Steve Alder

Settlements have been agreed to resolve class action data breach lawsuits against Omni Healthcare Financial Holdings and its subsidiaries, and Western Montana Clinic.

Omni Healthcare Financial Holdings Data Breach Settlement

Omni Healthcare Financial Holdings, along with defendants Omni Healthcare Financial, LLC, and Injury Finance, LLC (Omni Healthcare), have settled class action litigation over a January 2024 cybersecurity incident involving the protected health information of 16,852 individuals.

Omni Healthcare, a provider of financial solutions to healthcare organizations and patients, experienced a cybersecurity incident involving unauthorized network access between January 18 and January 19, 2024. Information exposed in the incident included names, contact information, dates of birth, Social Security numbers, diagnosis & treatment information, medical record numbers, treatment costs, provider names, and other information. The affected individuals were notified in April 2025, 15 months after the breach was first detected. In total, Omni Healthcare mailed around 42,000 notifications.

The first class action lawsuit was filed by plaintiff Latasha Hammond on April 16, 2025, followed by a second lawsuit by plaintiff Dawn Hairston. Both lawsuits were filed in the District Court for the Western District of North Carolina, and were consolidated, adding a further two plaintiffs – Hammond et al. v. Omni Healthcare Financial Holdings et al. The litigation was subsequently moved to the Superior Court of Mecklenburg County, North Carolina, where it is pending.

The consolidated lawsuit alleged that the data breach could have been prevented and occurred as a result of the defendants’ failure to implement appropriate industry-standard cybersecurity measures, and its failure to comply with the standards of the HIPAA Privacy and Security Rules. The lawsuit asserted claims for negligence/negligence per se, breach of implied contract, and unjust enrichment. The defendants deny all claims and contentions in the lawsuit, including claims of wrongdoing, fault, and liability.

The parties determined that a settlement was the best outcome, as it avoids further legal costs and the uncertainties of a trial and related appeals. The defendants will cover the cost of attorneys’ fees and expenses, settlement administration costs, service awards for the class representatives, and benefits for the class members.

Class members are entitled to enroll in three years of medical data monitoring and medical identity theft services and may submit a claim for one of two cash payments:

  • Cash Payment A – Reimbursement of documented, unreimbursed losses due to the data breach up to $5,000 per class member, or
  • Cash Payment B – A one-time cash payment of $40 per class member

The final approval hearing has been scheduled for August 13, 2026, and the claims deadline is September 3, 2026.

Western Montana Clinic Data Breach Settlement

Western Montana Clinic, a medical group practice in Missoula, MT, has settled a class action lawsuit stemming from a breach of its email environment in Spring 2025. Suspicious email activity was detected on April 15, 2025, and the forensic investigation confirmed unauthorized access to certain employee email accounts between March 11, 2025, and April 15, 2025.

The data review determined that the protected health information of 8,255 individuals was compromised, and 9,506 individuals were affected in total. Data exposed in the incident included contact information, Social Security numbers, dates of birth, treating physician names, internal identification numbers, dates of service, medication information, diagnostic information, and treatment information. The affected individuals were notified on August 8, 2025.

Western Montana Clinic was sued over the data breach, and the lawsuit – Murphy v. Western Montana Clinic – is pending in the Fourth Judicial District of Montana. The lawsuit claimed the data breach occurred as a result of the failure of the clinic to implement reasonable and appropriate cybersecurity measures, and asserted claims for negligence, negligence per se, breach of implied contract, and unjust enrichment. Western Montana Clinic denies wrongdoing and liability; however, it agreed to settle the lawsuit to avoid the litigation costs and expenses, distractions, burden, and disruption to its business operations associated with further litigation.

Western Montana Clinic has agreed to pay attorneys’ fees and expenses, settlement administration costs, $2,500 service awards to the two named plaintiffs, and class member benefits. Class members may claim a one-year membership to a medical data monitoring service, up to three hours of lost time at $20 per hour, and reimbursement of documented, unreimbursed out-of-pocket losses up to a maximum of $5,000 per class member. The deadline for exclusion and objection is August 17, 2026. Claims must be submitted by September 15, 2026, and the final fairness hearing has been scheduled for September 9, 2026.

The post Data Breach Lawsuits Settled by Omni Healthcare & Western Montana Clinic appeared first on The HIPAA Journal.

Privacy Concerns Raised Over Government Demand for Hospital Emergency Room Data

Posted by Steve Alder

The United States Consumer Product Safety Commission (CPSC) is requesting digital patient data from hospitals as part of its efforts to track consumer product-related injuries. By the end of the year, CPSC hopes that more than 100 hospitals will provide the requested records to the Kansas-based government contractor Konza Health, which was awarded a $15.9 million contract last year to support the National Electronic Injury Surveillance System (NEISS) Remodel project.

NEISS has been in operation for more than 5 decades, and its primary purpose is to collect data on consumer product-related injuries in the United States. NEISS is an important public health research tool; however, data collection is labor-intensive and involves a manual review and coding of medical records from around 70 of the nation’s 5,000+ hospital emergency departments. Currently, 14 states do not have any participating hospitals, which limits the geographic reach of the system and has reduced CPSC’s ability to identify rare and emerging product hazards.

Under the planned NEISS Remodel (NEISS-R) project, coverage will be expanded to all 50 states to ensure data is collected from currently underrepresented and non-represented states. The plan involves automating data collection by leveraging modem technology and the country’s electronic health record infrastructure. In so doing, CPSC said it will be able to identify rare and emerging hazards much more rapidly than the legacy system allows.

NEISS-R will see data exchanged through a federally designated Qualified Health Information Network (QHIN), which CPSC claims “is supported by contractual privacy requirements and standardized security safeguards.” The data collected will be limited, as will data retention, to the minimum necessary information to support CPSC’s statutory mission, and will support de-identification before the data reaches CPSC. CPSC says the project will result in a more timely, more accurate, and more cost-effective system, which will better protect American families.

Under the current system, emergency department nurses are required to review patient charts, manually identify consumer-related accidents, and enter that information into a national database. Under the new system, data collection would be automated, and it would be the responsibility of Konza Health, a TEFCA QHIN, to strip out identifying information prior to data transfers to CPSC.

According to the letters sent by Konza Health to hospitals, “Using accident-related diagnosis codes, Konza Health will identify patients that may have experienced a consumer product-related accident. For identified accidents, Konza Health will gather additional patient clinical information and provide it to CPSC for follow-up.” The letters request meetings with the selected hospitals to establish connectivity methods to allow secure data exchange for the project.

The NEISS-R project has sparked privacy fears, as under the manual system, nurses were instructed not to provide identifiable information such as patient names, addresses, or birth dates; however, the automated system would involve sending identifiable patient data Konza Health. While it is claimed that the data provided to CPSC will be unchanged from the information it has obtained for the past five decades, far broader access to patient data is sought.

KFF Health News reports that, based on emails shared by hospitals and interviews with people involved or familiar with the discussions between the hospitals and Konza Health, the data requested falls well outside of the CPSC’s consumer product safety mission. “In a stark departure from its product-focused mission, the agency’s goal is to obtain millions of Americans’ medical records from emergency room visits for most injuries, from a broken bone to a childhood vaccine reaction or even a suicide attempt,” explained KFF Health News. “A CPSC official also insisted in the emails that the institutions provide all ER patients’ identifiable information — such as names, addresses, diagnoses, and other personal details — to the contractor, Konza Health, for analysis.” According to communications between Konza Health and technology officials at one hospital, ER data is requested for more than 10,000 conditions, including injuries totally unrelated to consumer products.

CPSC and Konza Health have faced resistance from some hospitals over the mandatory provision of the data, and have suggested that refusing to provide the required data could be viewed as information blocking, potentially leading to significant penalties; however, the information being sought raises HIPAA concerns. Under HIPAA, hospitals are permitted, but not required, to submit data to CPSC for public health purposes, but any disclosure should be limited to the minimum necessary information to achieve the purpose for the disclosure. Since CPSC is collecting data to fulfil its consumer product safety mission, any data disclosed should be limited to that purpose. Should CPSC require more data than it has previously collected, further rulemaking would be necessary.

Participating hospitals could find themselves between a rock and a hard place – potential fines for information blocking if they do not agree to provide the requested data and potential HIPAA fines if they do. However, under the current information blocking regulations, there is a privacy exception, the purpose of which is to ensure that health information is not required to be disclosed in a way that is prohibited under state or federal privacy laws, and under the HIPAA minimum necessary standard, disclosures should be restricted to information required for CPSC’s public health activities, which concern consumer product safety.

The post Privacy Concerns Raised Over Government Demand for Hospital Emergency Room Data appeared first on The HIPAA Journal.