Jefferson County Health Department, a public health agency for Jefferson County in Hillsboro, Missouri, has agreed to settle class action litigation that was initiated in response to a 2022 data security incident.

The incident that sparked the litigation was identified on or around November 15, 2022. The forensic investigation determined that its network was accessed by an unauthorized third party between October 31 and November 15, 2022, who potentially viewed or obtained personal and protected health information such as names, dates of birth, Social Security numbers, driver’s license numbers, financial account information, medical information, and health insurance information. The data breach was reported to the HHS’ Office for Civil Rights on January 13, 2023, as involving the protected health information of 115,940 individuals.

The first class action lawsuit was filed on January 27, 2023, and was consolidated with a second complaint on October 2, 2023. The consolidated lawsuit – J.D., et al. v. Jefferson County Health Center d/b/a Jefferson County Health Department – is pending in the Circuit Court of the City of St. Louis, State of Missouri.

The consolidated lawsuit alleged that the plaintiffs would not have sought healthcare services from Jefferson County Health Center if they knew that their personal and health information would not be adequately protected. They claim that the failure to implement appropriate cybersecurity measures constituted negligence, breach of contract, breach of fiduciary duty, and violated the covenant of good faith and fair dealing. Jefferson County Health Department maintains that there was no wrongdoing and does not believe there is any liability or that there were any damages. A motion to dismiss the lawsuit was denied by the court, and a settlement was ultimately negotiated that was acceptable to all parties and avoids the cost and risks associated with a trial and related appeals.

Get The FREE
HIPAA Compliance Checklist

Immediate Delivery of Checklist Link To Your Email Address

Business Email *

Name *

First

Last

Number *

Company Name *

Get Free Checklist

Please Enter Correct Email Address

Your Privacy Respected

HIPAA Journal Privacy Policy

Under the terms of the settlement, Jefferson County Health Department has agreed to establish a $2.25 million settlement fund, from which attorneys’ fees and expenses, settlement administration costs, and service awards for the three class representatives will be deducted. The remainder of the fund will be used to pay for benefits to the class members.

Class members may either submit a claim for reimbursement of documented, unreimbursed losses due to the data breach up to a maximum of $300 per class member, including up to three hours of lost time at $20 per hour. Individuals who do not submit a claim for reimbursement of losses and lost time may claim a one-time cash payment of $150. The deadline for exclusion from the settlement, objection, and submitting a claim is November 16, 2026. The final fairness hearing has been scheduled for December 10, 2026.

The post Jefferson County Health Department Pays $2.25M to Settle Data Breach Lawsuit appeared first on The HIPAA Journal.

In July, a coalition of 42 state attorneys general agreed to an $18 million settlement with 23andMe to resolve claims that the company violated state laws by failing to implement appropriate data security measures to prevent credential-based attacks. California did not participate in the action, having opted to pursue its own legal claims against the company. A settlement has now been agreed between 23andMe and California to resolve the alleged violations of California laws.

The data breach, covered by the HIPAA Journal in this post, exposed the personal information and genetic information of approximately 6.9 million individuals, including 855,000 California residents. While the attack involved credential stuffing and took advantage of 23andMe customers’ poor password security practices, the states argued that the company should have been aware that there was a risk of customer accounts being targeted, and the company should therefore have implemented security measures for detecting and blocking attacks on customer accounts.

Following the security incident, 23andMe filed for bankruptcy protection and the company was bought for $305 million by TTAM Research Institute, a non-profit controlled by 23andMe co-founder Anne Wojcicki. California attempted to block the sale of the company, claiming it violated the California Genetic Information Privacy Act because 23andMe customers had not given their consent to the sale, which involved the transfer of their personal and genetic information to TTAM Research Institute. The state’s attempt to block the sale was unsuccessful, and a bankruptcy court judge ruled that California could not sue TTAM Research Institute over the data breach to recover money.

California planned to appeal the ruling; however, under the data breach settlement agreement, the state has agreed to drop further appeals. Under the terms of the settlement, California will be paid $6 million. While the sale of the company and transfer of customer data to TTAM Research Institute will go ahead, 23andMe customers have the right to request that their personal and genetic data be deleted.

Get The FREE
HIPAA Compliance Checklist

Immediate Delivery of Checklist Link To Your Email Address

Business Email *

Name *

First

Last

Number *

Company Name *

Get Free Checklist

Please Enter Correct Email Address

Your Privacy Respected

HIPAA Journal Privacy Policy

“I am proud to fight for the privacy rights of Californians and to deliver this settlement for consumers ​who put their trust in 23andMe,” said California Attorney General Rob Bonta. “I want to remind Californians that customers of 23andMe can delete their private, genetic data — no matter who owns it.” In addition to the $24 million in settlements, 23andMe agreed to settle class action data breach litigation and will pay $46.75 million to its customers. The settlement was approved by the court in July 2026.

The post California Settles 23andMe Data Breach Lawsuit for $6 Million appeared first on The HIPAA Journal.

An $80 million settlement has been proposed to resolve a consolidated class action lawsuit against Conduent Business Services, LLC, over its 2024 cybersecurity incident and data breach. Conduent, a leading provider of front-office and back-office solutions, notified the U.S. Securities and Exchange Commission (SEC) in April that it had experienced a cybersecurity incident. An unauthorized third party first breached its network on October 21, 2024, and maintained access until January 13, 2025. The SafePay ransomware group claimed to have exfiltrated 8.5 terabytes of data in the attack.

Conduent’s forensic investigation determined that the personal and protected health information of approximately 62.2 million individuals was stolen in the incident, including names, addresses, dates of birth, medical information, health insurance information, and Social Security numbers. It was the largest healthcare data breach reported in 2025 and ranks as the third-largest healthcare data breach of all time.

Conduent Business Services LLC, Conduent State & Local Solutions, Inc., and Conduent Incorporated faced multiple class action lawsuits in response to the data breach. The lawsuits were consolidated into a single complaint – In Re Conduent Business Services Data Breach Litigation – as they had overlapping claims and classes. The lawsuit is pending in the U.S. District Court for the District of New Jersey.

The consolidated lawsuit alleged that the defendants failed to implement reasonable and appropriate safeguards to protect individuals’ sensitive personal and protected health information. The lawsuit had 16 causes of action, including negligence and violations of the California Consumer Privacy Act, California Confidentiality of Medical Information Act, and California Customer Records Act. The defendants disagree with the claims and contentions in the lawsuit, including claims of wrongdoing and liability.

Get The FREE
HIPAA Compliance Checklist

Immediate Delivery of Checklist Link To Your Email Address

Business Email *

Name *

First

Last

Number *

Company Name *

Get Free Checklist

Please Enter Correct Email Address

Your Privacy Respected

HIPAA Journal Privacy Policy

The $80 million settlement was proposed following mediation and covers the 62.2 million individuals affected by the breach, approximately 40 million of whom are in Subclass A and 22 million are in Subclass B. Individuals in Subclass A had data stolen in the attack, but it was stored in complex backup files that made their data difficult to access. Individuals in Subclass B had private information stolen in a readily accessible format.

All class members are entitled to claim one year of single-bureau credit monitoring services, valued at $179.40 per year. All class members may also submit a claim for reimbursement of documented, unreimbursed losses due to the data breach up to a maximum of $3,500 per class member. Members of subclass B may also submit a claim for a pro rata cash payment, the value of which will depend on the remaining funds after attorneys’ fees and expenses, settlement administration costs, service awards for the class representatives, credit monitoring services, and claims have been paid. The attorneys are seeking 34% of the settlement fund, and the class representatives will be paid $1,500 each. Individuals who were California residents at the time of the breach will also be eligible for an additional payment, equal to the pro rata cash payment plus 20%. The settlement awaits approval from the court, after which the dates for objection, exclusion, and submitting a claim will be set.

The post $80 Million Settlement Proposed to Resolve Conduent Data Breach Litigation appeared first on The HIPAA Journal.

A settlement has been agreed to partly resolve litigation stemming from a cyberattack on American Collection Medical Agency (AMCA).  The settlement resolves the “Other Labs Track” of the litigation and has been agreed to by the plaintiffs and AMCA clients Sonic Healthcare U.S.A., Aurora Diagnostics LLC, Clinical Pathology Laboratories, Inc., and Austin Pathology Associates. The defendants have agreed to pay $6,438,578.20 to resolve all claims against them related to the AMCA data breach.

AMCA, a subsidiary of Retrieval-Masters Creditors Bureau, Inc., specializes in recovering small-balance medical debt for clinical laboratories and healthcare providers. The company identified a cyberattack on March 30, 2029, and the forensic investigation determined that an unauthorized third party had access to sensitive data between August 1, 2018, and March 30, 2019, following an attack on AMCA’s web payment portal. Data compromised in the incident included names, contact information, government-issued identifiers, medical billing information, financial account and payment information. More than 27 million individuals are believed to have been affected in total.

Many lawsuits were filed against AMCA and its clients in response to the data breach, asserting claims for negligence, breach of contract, and other claims. The lawsuits were consolidated in the U.S. District Court for the District of New Jersey, and after six years of hard-fought litigation, the defendants on this track – In Re: American Medical Collection Agency, Inc. Customer Data Security Breach Litigation (All Actions Against Other Labs Track) – have agreed to a settlement to avoid further litigation costs and the uncertainty of a trial and any associated appeals. The defendants continue to deny wrongdoing and liability and maintain that the plaintiffs and class members have not suffered any injury or damage as a result of the cyberattack or data breach.

The defendants have agreed to establish a $6,438,578.20 settlement fund to cover all costs and expenses related to the litigation, including attorneys’ fees and expenses, settlement administration and notice costs, service awards for the class representatives, and claims from the class members. Class members are entitled to claim two years of medical and health information monitoring through the CyEx Medical Shield Pro service. In addition, a claim may be submitted for compensation for documented, unreimbursed out-of-pocket losses due to the data breach up to a maximum of $5,000 per class member, which may include up to 10 hours of documented lost time at $25 per hour.

Get The FREE
HIPAA Compliance Checklist

Immediate Delivery of Checklist Link To Your Email Address

Business Email *

Name *

First

Last

Number *

Company Name *

Get Free Checklist

Please Enter Correct Email Address

Your Privacy Respected

HIPAA Journal Privacy Policy

Class members who choose not to submit a claim for compensation of losses and/or lost time may choose to receive a one-time cash payment, the value of which will depend on the claims received, but has been estimated to be approximately $50. The important dates for class members are a deadline of December 3, 2026, for objecting to and opting out of the settlement, and January 4, 2027, for submitting a claim. The final fairness hearing has been scheduled for January 7, 2026.

The post $6.4 Million Settlement Agreed in AMCA Customer Data Breach Litigation appeared first on The HIPAA Journal.

Twin Cities Pain Clinic, an Edina, Minnesota-based pain management center, has settled class action litigation arising from a July 2025 data incident that exposed patients’ personal and protected health information. A cybercriminal gained access to an employee’s email account in a business email compromise attack, exposing patient information such as names, dates of birth, addresses, email addresses, phone numbers, financial account information, medical record numbers, treatment notes, provider information, health insurance information, and Social Security numbers. The data breach was reported to the HHS’ Office for Civil Rights as affecting 3,572 patients.

Multiple class action lawsuits were filed in response to the data breach, alleging the defendant was at fault. The lawsuits were consolidated into a single action – In re Twin Cities Pain Clinic Data Breach Litigation – in the District Court of Hennepin County, Minnesota. The consolidated lawsuit asserted claims for negligence, negligence per se, breach of contract, breach of implied contract, unjust enrichment, breach of fiduciary duty, breach of confidence, and violations of the Minnesota Uniform Deceptive Trade Practice Act and Minnesota Health Records Act.

Twin Cities Pain Clinic maintains there was no wrongdoing and disagrees with the claims and contentions in the lawsuit; however, a settlement has been agreed upon that is acceptable to all parties to avoid the cost, distraction, burden, risks, and disruption to business operations from protracted litigation. Twin Cities Pain Clinic has agreed to pay attorneys’ fees and expenses, settlement administration costs, service awards to the class representatives, and cash payments to the class members.  The cash payments are subject to a $385,000 cap and will be paid pro rata if that total is exceeded.

Class members may choose to submit a claim for reimbursement of documented, unreimbursed losses incurred between July 9, 2025, and November 9, 2026, up to a maximum of $450 for ordinary losses, and up to $4,500 for extraordinary losses. Alternatively, a claim may be submitted for a flat cash payment, estimated to be $55 per class member. The deadline for objection, opting out, and submitting a claim is November 9, 2026. The final fairness hearing has been scheduled for January 20, 2027.

Get The FREE
HIPAA Compliance Checklist

Immediate Delivery of Checklist Link To Your Email Address

Business Email *

Name *

First

Last

Number *

Company Name *

Get Free Checklist

Please Enter Correct Email Address

Your Privacy Respected

HIPAA Journal Privacy Policy

The post Twin Cities Pain Clinic Settles Data Breach Litigation appeared first on The HIPAA Journal.

Roseland Community Hospital Association in Illinois has agreed to settle a class action data breach lawsuit for $650,000. The lawsuit was filed in response to a 2024 cybersecurity incident that exposed sensitive patient and employee information. The attack was detected on June 2, 2024, and the investigation determined that names, dates of birth, addresses, medical record numbers, patient account numbers, health insurance information, diagnoses, and treatment information were present in the exposed data.

The data breach was reported to the HHS’ Office for Civil Rights using an estimate of at least 500 affected individuals, as required by the HIPAA Breach Notification Rule; however, that total has not been updated since the initial report, even though the data breach was far more extensive. According to court documents, the personal and protected health information of 101,354 individuals was potentially compromised in the incident. The affected individuals started to be notified on August 1, 2024.

On November 25, 2024, a class action lawsuit was filed by plaintiff Steven Hall in the Circuit Court of Cook County, Illinois, individually and on behalf of his three minor children. The lawsuit was consolidated with two further complaints as they had overlapping claims and classes. The plaintiffs alleged that the defendant was at fault, as reasonable cybersecurity measures had not been implemented as required by HIPAA, including but not limited to data encryption and logging, monitoring, and alerting tools. The lawsuit asserted claims for negligence, negligence per se, breach of implied contract, unjust enrichment, breach of bailment, invasion of privacy/disclosure of private information, and violation of the Illinois Consumer Fraud and Deceptive Business Practices Act.

The defendant maintains there was no wrongdoing and filed a motion to dismiss, which was granted in part and denied in part. The consolidated lawsuit – Hall, et al. v. Roseland Community Hospital Association – is pending in the Circuit Court of Cook County, Illinois. The parties engaged in settlement discussions and negotiated a settlement to avoid the costs and risks associated with protracted litigation. The settlement has recently received preliminary approval from the court.

Get The FREE
HIPAA Compliance Checklist

Immediate Delivery of Checklist Link To Your Email Address

Business Email *

Name *

First

Last

Number *

Company Name *

Get Free Checklist

Please Enter Correct Email Address

Your Privacy Respected

HIPAA Journal Privacy Policy

Under the terms of the settlement, Roseland Community Hospital Association has agreed to pay $650,000 to settle the lawsuit, inclusive of attorneys’ fees and expenses, settlement administration and notice costs, service awards for the class representatives, and benefits for the class members. Class members may claim one year of medical data monitoring services, reimbursement of documented losses due to the data breach up to a maximum of $5,000 per class member, and a pro rata cash payment, estimated to be $50 per class member. The cash payments are subject to a pro rata adjustment based on the number of claims received.

The deadline for objection and opting out is December 1, 2026. Claims must be submitted by December 31, 2026, and the final fairness hearing has been scheduled for January 6, 2027.

The post Roseland Community Hospital Association Settles Data Breach Lawsuit for $650,000 appeared first on The HIPAA Journal.

Etairos Health has agreed to settle class action litigation stemming from a February 20, 2024, ransomware attack and data breach that exposed the personal information of current and former employees. A ransomware group breached its network and potentially viewed or obtained employee information such as names, phone numbers, addresses, government-issued ID numbers, and Social Security numbers. The affected individuals were notified on or around March 22, 2024.

A class action lawsuit – Isabel Garcia Bueno v. Etairos Health, Inc. – was filed by plaintiff Isabel Garcia Bueno on May 14, 2024, asserting claims for negligence and breach of implied contract. The plaintiff alleged that Etairos Health should have prevented the data breach and would have been able to if appropriate cybersecurity measures had been implemented. The lawsuit is pending in the Circuit Court for the Sixth Judicial Circuit in and for Pinellas County, Florida. Etairos Health denies wrongdoing, liability, and all the claims and contentions in the lawsuit, and the plaintiff believes the claims asserted in the litigation have merit. To avoid the time, cost, and risks associated with continued litigation, all parties agreed to a settlement.

The negotiated settlement includes up to $146,500 in attorneys’ fees and expenses, a $3,500 service award for the class representative, and benefits for the class members. Class members may claim up to $4,500 as reimbursement for documented, unreimbursed losses due to the data breach, including up to eight hours of lost time at $15 per hour (max $120). Class members who chose not to submit a claim for reimbursement of losses and/or lost time may claim a one-time cash payment of $75.

The deadline for exclusion and objection is November 20, 2026. The deadline for submitting a claim is December 21, 2026. The final approval hearing has been scheduled for January 20, 2027.

Get The FREE
HIPAA Compliance Checklist

Immediate Delivery of Checklist Link To Your Email Address

Business Email *

Name *

First

Last

Number *

Company Name *

Get Free Checklist

Please Enter Correct Email Address

Your Privacy Respected

HIPAA Journal Privacy Policy

The post Etairos Health Settles Ransomware-Related Class Action Lawsuit appeared first on The HIPAA Journal.

Valley Oaks Health faced class action litigation over a June 2023 data security incident that affected 50,352 individuals. The consolidated lawsuit has recently been settled. Hackers accessed the Valley Oaks Health network between June 8, 2023, and June 13, 2023, and potentially obtained files containing names, Social Security numbers, driver’s license numbers, state ID numbers, credit/debit card numbers, access codes/passwords, biometric data, and other sensitive information.

Multiple class action lawsuits were filed in response to the data breach, which were consolidated into a single action – In re: Valley Oaks Data Incident Litigation – as the lawsuits had overlapping claims and classes. The consolidated lawsuit is pending in the Superior Court for Tippecanoe, Indiana. The consolidated lawsuit asserted claims for negligence, negligence per se, breach of implied contract, breach of fiduciary duty, and unjust enrichment, all of which are denied by Valley Oaks Health, which maintains there was no wrongdoing.

Valley Oaks Health sought to have the lawsuit dismissed; however, the motion to dismiss was rejected by the court. A full day of mediation did not result in a settlement; however, after several months of negotiations, a settlement was agreed to avoid the cost, delay, and risks of protracted litigation.  The settlement has recently received preliminary approval from the court.

Valley Oaks Health has agreed to pay attorneys’ fees and expenses, settlement notification and administration costs, and service awards for the seven class representatives (total of $17,500). Attorneys’ fees are capped at $450,000. Claims may be submitted for reimbursement of up to $500 in documented, unreimbursed ordinary losses due to the data breach, including up to four hours of lost time at $20 per hour. A claim may also be submitted for up to $5,000 as reimbursement for documented, unreimbursed extraordinary losses. If claims are not submitted for reimbursement of losses or lost time, a claim may be submitted for an alternative $40 cash payment. All class members are entitled to enroll in two years of medical data monitoring services.

Get The FREE
HIPAA Compliance Checklist

Immediate Delivery of Checklist Link To Your Email Address

Business Email *

Name *

First

Last

Number *

Company Name *

Get Free Checklist

Please Enter Correct Email Address

Your Privacy Respected

HIPAA Journal Privacy Policy

The deadline for opting out, objecting to the settlement, and submitting a claim is November 9, 2026. The final fairness hearing has been scheduled for December 10, 2026.

The post Valley Oaks Health Data Breach Settlement Gets First Nod from Court appeared first on The HIPAA Journal.

Laboratory Services Cooperative, a Seattle, Washington-based nonprofit clinical laboratory that provides diagnostic and analytical testing services for Planned Parenthood affiliates in 31 U.S. states, has agreed to settle class action litigation arising from a 2024 data breach that affected approximately 1.6 million current and former patients and employees.

The data breach

On October 27, 2024, Laboratory Services Cooperative identified unauthorized network activity. The forensic investigation determined that a hacker accessed its network and removed data. The compromised information includes names, dates of birth, contact information, medical information, claims information, billing information, health insurance information, Social Security numbers, and other government- and state-issued identifiers. The notification letters did not state how long hackers had access to its network. The affected individuals started to be notified on or around April 10, 2025. The HHS’ Office for Civil Rights was notified on November 20, 2024. The OCR breach portal still lists the incident as affecting 501 individuals.

The litigation

Get The FREE
HIPAA Compliance Checklist

Immediate Delivery of Checklist Link To Your Email Address

Business Email *

Name *

First

Last

Number *

Company Name *

Get Free Checklist

Please Enter Correct Email Address

Your Privacy Respected

HIPAA Journal Privacy Policy

Several class action lawsuits were filed in response to the data breach, which were consolidated as they asserted similar claims and had overlapping classes. The consolidated lawsuit – In re Laboratory Services Cooperative Data Breach Litigation – is pending in the U.S. District Court for the Western District of Washington.

The plaintiffs allege that the data breach occurred because the defendant’s data security systems were completely inadequate, and the company failed to follow industry-standard cybersecurity practices. Further, the breach notifications were delayed, and the notices failed to include important information about the breach. The lawsuit asserted claims for negligence, breach of contract, unjust enrichment, invasion of privacy, and declaratory and injunctive relief.

The defendant disagrees with the claims and contentions in the lawsuit, including claims of wrongdoing, fault, and liability. The parties agreed to a settlement to avoid the cost, delay, distraction, and risks associated with a trial and related appeals.

The settlement

Laboratory Services Cooperative has agreed to establish a $6,100,000 settlement fund to resolve the litigation, from which costs and expenses will be deducted, and the remaining funds will be used to pay benefits to the class members. Costs and expenses include attorneys’ fees (up to one-third of the settlement fund) and expenses, notice and settlement administration costs, and service awards of up to $2,500 for the class representatives.

Class members are entitled to submit a claim for reimbursement of documented, unreimbursed losses due to the data breach, a pro rata cash payment, and two years of credit and medical information monitoring services. Reimbursement claims are capped at $5,000 per class member, and the pro rata cash payments will be up to $1,000 per class member but may be lower depending on the number of claims received. Cash payments will be affected by the number of reimbursement claims and the number of individuals signing up for credit monitoring services.

Laboratory Services Cooperative has made changes to its business practices and implemented security enhancements to reduce the risk of similar incidents in the future. The deadline for objection and exclusion is October 26, 2026. The deadline for filing a claim is November 24, 2026, and the final fairness hearing is scheduled for January 4, 2027.

The post Laboratory Services Cooperative Agrees to Pay $6.1 Million to Settle Data Breach Litigation appeared first on The HIPAA Journal.