Memorial Healthcare Services Settles Pixel Litigation

Posted by Steve Alder

Memorial Healthcare Services, a nonprofit healthcare provider serving patients in Southern California, has agreed to settle a class action lawsuit over its use of pixels and other tracking, web analytics, and advertising technologies on its website.

The tools are alleged to have been added to the website without the knowledge or consent of patients, causing website users’ personally identifiable information (PII) to be collected and transferred to third parties.  The disclosures of PII and health information without consent are alleged to have violated the  California Invasion of Privacy Act. Memorial Healthcare Services maintains that there was no wrongdoing.

The lawsuit – Valladolid v. Memorial Health Services – was filed by plaintiff Michelle Valladolid in the Superior Court of California, County of Los Angeles, individually and on behalf of similarly situated individuals. After considering the likely cost of continuing with the litigation and risks associated with a trial and related appeals, the defendant and plaintiff agreed to settle the litigation.

The parties were not able to agree to the terms of a settlement during a full-day mediation session on April 3, 2025; however, through ongoing negotiations, the material terms of a settlement were agreed upon, and the terms have now been finalized. The proposed settlement has received preliminary approval from the court, and the final fairness hearing has been scheduled for September 17, 2026. The class consists of individuals who accessed the Memorial Health Services patient portal between March 7, 2022, and July 8, 2022.

Under the terms of the settlement, class members may claim a one-time cash payment, which will be paid pro rata from the $750,000 settlement fund. The defendant has agreed to cover the cost of attorneys’ fees and expenses, settlement administration and notification costs, and a service award for the class representative, which will be deducted from the settlement fund before any cash payments are made. The remaining funds will be shared equally between all class members who submit a valid claim.

Individuals wishing to object to the settlement must do so by July 15, 2026. The deadline for opting out is August 21, 2026, and claims must be submitted by August 21, 2026. Further information can be found on the settlement website: https://mhspixelsettlement.com/

The post Memorial Healthcare Services Settles Pixel Litigation appeared first on The HIPAA Journal.

Data Security Incidents Announced by Park Dental Research Corp; Wabi Sabi Behavioral Health Center

Posted by Steve Alder

Employee data has been compromised in data security incidents at Park Dental Research Corporation in Oklahoma and Wabi Sabi Behavioral Health Center in Nebraska.

Park Dental Research Corporation

Park Dental Research Corporation, an Ardmore, OK-based dental implant company, has notified individuals about a security incident it experienced on or around April 29, 2026. The investigation confirmed that an unauthorized third party had access to systems containing information such as names, dates of birth, addresses, Social Security numbers, driver’s license numbers, bank account information, passports, and I-9 forms.

There has been no known misuse of the affected information; however, as a precaution against data misuse, the affected individuals have been offered complimentary credit monitoring and identity theft protection services, which include a $1,000,000 identity theft insurance policy. Notification letters were mailed to the affected individuals on June 24, 2026.

While ransomware was not mentioned in the notification letters, a ransomware group called Interlock took responsibility for the cyberattack and claimed to have exfiltrated 260 gigabytes of data from the company’s systems.

Wabi Sabi Behavioral Health Center

Hastings, NE-based Wabi Sabi Behavioral Health Center, a multidisciplinary mental health provider serving patients in South Central Nebraska, has identified unauthorized access to parts of its network containing employee payroll records. On June 15, 2026, an unauthorized third party gained access to a QuickBooks Online account using compromised credentials. The purpose of the attack was to make changes to employees’ account details in order to divert payments to attacker-controlled accounts. The unauthorized access was detected on the same day, and changes to payroll were identified.

While the affected accounts have been secured, employee information such as names, addresses, and Social Security numbers may have been viewed or copied. The affected individuals have been notified and offered complimentary credit monitoring and identity theft protection services. No misuse of employee data has been identified as a result of the incident. The Nebraska Attorney General has been informed about the data breach, but the number of affected individuals has not been publicly disclosed.

The post Data Security Incidents Announced by Park Dental Research Corp; Wabi Sabi Behavioral Health Center appeared first on The HIPAA Journal.

Calibrated Healthcare Settles Class Action Data Breach Lawsuit

Posted by Steve Alder

Calibrated Healthcare Systems, LLC, and Calibrated Healthcare, LLC, have agreed to settle a class action lawsuit stemming from a February 2024 security incident that exposed patient information.

Calibrated Healthcare identified a security incident on February 26, 2024, and its investigation determined that there had been unauthorized access to its network between February 25, 2024, and February 26, 2024. While data theft was not confirmed, Calibrated Healthcare said data theft was likely. Data compromised in the incident included names, dates of birth, medical diagnosis/treatment information, and health insurance information.

The data breach was reported to the HHS’ Office for Civil Rights (OCR) as involving the protected health information of 6,890 individuals, and the affected individuals were notified on or around August 2, 2024. Two putative class action lawsuits were filed in response to the data breach: Adams v. Calibrated Healthcare Systems, LLC, et al and Holden v. Calibrated Healthcare, LLC, which were consolidated in the District Court for the Central District of California, Southern Division – Adams, et al. v. Calibrated Healthcare Systems, LLC, et al.

The consolidated lawsuit alleged that the data breach was due to the defendants’ negligence and should have been prevented. The lawsuit asserted claims for negligence, invasion of privacy, breach of contract, breach of implied contract, unjust enrichment, and violations of the California Unfair Competition Law Bus. & Prof. Code for unlawful, fraudulent, and unfair business practices, violation of the California Consumers Legal Remedies Act, and violation of the California Consumers Legal Remedies Act.

The defendants deny all claims and contentions in the lawsuit, including claims of fault, wrongdoing, and liability. The parties attended mediation, and while a settlement was not agreed during mediation, settlement negotiations continued, and a settlement acceptable to all parties has now been agreed. The settlement has received preliminary approval from the court.

While the OCR breach portal still lists the incident as involving the protected health information (PHI) of 6,890 individuals, there are 34,562 individuals in the settlement class. The settlement provides all class members with two years of medical monitoring and identity theft insurance services, and a monetary payment of between $21.44 and $28.68, depending on the number of valid claims received for reimbursement of out-of-pocket costs and lost time.

Class members may claim up to seven hours of documented lost time due to the data breach at $25 per hour (Maximum $175 per class member). A claim may also be submitted for reimbursement of documented losses fairly traceable to the data breach up to a maximum of $5,000 per class member. Claims must be submitted by July 9, 2026, and the final fairness hearing has been scheduled for August 13, 2026.

The post Calibrated Healthcare Settles Class Action Data Breach Lawsuit appeared first on The HIPAA Journal.