True Health New Mexico Proposes Settlement to Resolve Class Action Data Breach Lawsuit
The Albuquerque, NM-based health insurance provider, True Health New Mexico, has proposed a settlement to resolve claims related to a 2021 HIPAA data breach that affected 62,983 members of its health plans.
True Health New Mexico identified a security breach on October 5, 2021, with the investigation confirming that an unauthorized third party had gained access to its network and used ransomware to encrypt files. During the period of access, files were potentially viewed and exfiltrated that contained plan member data such as names, dates of birth, ages, home addresses, email addresses, insurance information, medical information, Social Security numbers, health account member IDs, provider information, and date(s) of service. No evidence of misuse of plan member data was identified at the time of issuing notification letters; however, as a precaution against identity theft and fraud, complimentary credit monitoring and identity theft protection services were offered to affected individuals.
Several lawsuits were filed soon after notifications were sent alleging the health plan provider was negligent for failing to take appropriate care to protect sensitive customer and employee data. The lawsuits also alleged negligence per se, invasion of privacy by intrusion, breach of express contract, breach of implied contract, breach of fiduciary duty, unjust enrichment, and violations of the New Mexico Unfair Practices Act.
The lawsuits sought reimbursement of out-of-pocket expenses, recovery of losses to identity theft and fraud, and True Health New Mexico to ensure that security is improved to prevent further data breaches. True Health New Mexico proposed the settlement to resolve claims related to these lawsuits with no admission of wrongdoing. Claims will be accepted from individuals who received notifications about the data breach and were represented in three class action lawsuits, McCullough, et al. v. True Health New Mexico Inc., Clement, et al. v. True Health New Mexico Inc., and Shanks, et al. v. True Health New Mexico Inc., all of which were filed in the 2nd District Court of the State of New Mexico. The three lawsuits were consolidated into a single class action lawsuit on March 21, 2022.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Under the terms of the proposed settlement, claims will be accepted up to a maximum of $5,250 per individual. Up to $250 can be claimed as reimbursement for ordinary expenses related to the data breach, such as bank fees, credit monitoring costs, and communication charges, as well as up to 5 hours of lost time at $20 per hour. Claims will also be accepted for documented extraordinary losses up to a maximum of $5,000, which can include losses to identity theft and fraud that can be reasonably traced to the data breach, as well as up to 3 hours of additional time at $20 per hour. The settlement also includes attorneys fees and awards of up to $1,500 for named plaintiffs and an additional 2 years of three-bureau credit monitoring services and identity theft insurance, provided by Equifax, from the date of the settlement.
True Health New Mexico has also agreed to improve security, which includes maintaining a written information security policy, providing cybersecurity training to the workforce, implementing a password policy, multi-factor authentication, and an endpoint detection and response solution; however, the settlement includes a clause that allows the health plan provider to escape the obligation to improve security. “In the event True Health discontinues operations, True Health will have no obligation to continue these equitable measures.”
True Health New Mexico, a wholly owned subsidiary of Bright Health, has already stopped providing health plans to New Mexico residents and will only provide coverage to existing health plan members until June 30, 2023, as Bright Health has decided to focus on markets where it will have the greatest impact.
The deadline for objection to or exclusion from the settlement is April 14, 2023. Claims must be submitted no later than August 14, 2023. The final fairness hearing has been scheduled for May 10, 2023.
