Healthcare Privacy and Data Breach Class-Action Settlements

Several healthcare organizations are resolving class-action litigation tied to alleged exposure of sensitive patient data, with settlements emphasizing cost avoidance rather than admissions of wrongdoing. Kaiser Permanente agreed to a $46 million settlement over claims that patient interactions with certain Kaiser websites and digital tools resulted in personal health information being transmitted to third parties (including Google, Microsoft Bing, Twitter/X, and Adobe) via online tracking/advertising technologies; the allegations focus on web/digital activity rather than Kaiser’s core electronic medical record systems, and the proposed class period spans 2017–2024.

Separately, two healthcare entities reached settlements following network intrusions that allegedly exposed protected health information and other sensitive identifiers. Mystic Valley Elder Services agreed to pay $520,000 to settle claims stemming from an April 2024 incident in which attackers accessed its network and potentially obtained data including SSNs, financial/payment data, credentials, and medical/insurance information affecting ~89,600 people; plaintiffs also alleged delayed detection and notification. Consulting Radiologists Ltd. received approval for a $2.2 million settlement after a 2024 intrusion affecting up to 583,824 individuals, with allegations including inadequate security controls and delayed breach notification; the organization reported that some impacted records included medical/insurance data and SSNs (for a subset of individuals).