Settlements have been agreed to resolve class action data breach lawsuits against Vida Y Salud-Health Systems & Hampton Regional Medical Center.
Vida Y Salud-Health Systems Class Action Data Breach Settlement
Vida Y Salud-Health Systems, a non-profit community-based medical organization and Federally Qualified Health Center in Crystal City, Texas, has agreed to settle class action litigation arising from an October 2025 data security incident that exposed the personal and protected health information of 35,236 individuals. The incident that sparked the lawsuit was first identified on October 7, 2025. The forensic investigation determined that an unauthorized third party accessed its network between October 7 and October 8, 2025, and potentially obtained files containing names, Social Security numbers, credit card/bank account numbers, claims information, and diagnosis/condition information.
Multiple class action lawsuits were filed in response to the data breach. Since the lawsuits made similar claims and had overlapping classes, they were consolidated into a single complaint – Murray et al. v. Vida Y Salud-Health Systems, Inc. – in the 293rd District Court for Zavala County, Texas. The lawsuit names four plaintiffs as class representatives.
The plaintiffs allege that the data breach occurred as a result of a failure of the defendant to implement appropriate cybersecurity measures. The consolidated lawsuit asserted claims for negligence, negligence per se, breach of implied contract, unjust enrichment, invasion of privacy—intrusion upon seclusion, and breach of fiduciary duty. Vida Y Salud-Health Systems disagrees with those claims and maintains there was no wrongdoing.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
All parties agreed to a settlement to avoid the cost and risks of protracted litigation. Under the terms of the settlement, class members may claim two years of credit monitoring services and a cash payment. Up to $3,500 may be claimed as compensation for documented, unreimbursed losses due to the data breach, up to $3,500 per class member, plus up to four hours of lost time at $20 per hour. If a claim for reimbursement of losses and/or lost time is not submitted, class members may claim an alternative $50 cash payment. Claims are capped at a maximum of $500,000 and will be subject to a pro rata reduction if that total is exceeded. The deadline for objection and opting out is January 4, 2027. The deadline for submitting a claim is January 18, 2027. The final fairness hearing has been scheduled for February 2, 2027.
Hampton Regional Medical Center Class Action Data Breach Settlement
Hampton Regional Medical Center, a nonprofit community hospital in Varnville, South Carolina, has agreed to pay $250,000 to resolve class action litigation stemming from a data security incident last year. Hackers had access to its network from June 18, 2025, to July 16, 2025, and potentially obtained patient data, including names, birth dates, Social Security numbers, driver’s license numbers, demographic information, and medical information. Notification letters started to be mailed to the affected individuals on September 12, 2025. The data breach is still listed on the HHS’ Office for Civil Rights breach portal as affecting 501 individuals.
Two class action lawsuits were filed in response to the data breach, which were consolidated into a single complaint – In re Hampton Regional Medical Center Data Incident Litigation – which is pending in the Court of Common Pleas for the Fourteenth Judicial Circuit, Hampton County, South Carolina. The plaintiffs allege that the defendant was at fault and should have prevented the incident. The lawsuit asserted claims for negligence, negligence per se, breach of implied contract, unjust enrichment, and breach of confidence. The defendant maintains that there was no wrongdoing.
The parties attended mediation and agreed to the terms of a settlement, which has received preliminary approval from the court. Class members may claim reimbursement for documented, unreimbursed losses up to $5,000 per class member or an alternative pro rata cash payment, estimated to be $20 per class member. In addition to one of those cash payments, class members are entitled to one year of single-bureau credit monitoring services. The deadline for objection and opting out is December 24, 2026. The deadline for submitting a claim is January 11, 2027. The final fairness hearing has been scheduled for January 25, 2027.
The post Vida Y Salud-Health Systems & Hampton Regional Medical Center Settle Data Breach Lawsuits appeared first on The HIPAA Journal.