Washington Gastroenterology Pays $4.6 Million to Settle Data Breach Lawsuit
Washington Gastroenterology has agreed to pay $4,600,000 to settle class action litigation stemming from a cybersecurity incident that was identified on January 28, 2025. Hackers gained access to its network on October 23, 2024, and potentially stole the personal and protected health information of 583,741 individuals, including names, Social Security numbers, financial and banking information, medical information, and health insurance information. The affected employees were notified about the incident on May 23, 2025, and patients were notified on August 22, 2025.
Several class action lawsuits were filed in response to the breach. The lawsuits were consolidated into a single complaint – In re Washington Gastroenterology, PLLC Data Breach Litigation – as they asserted similar claims and had overlapping classes. The consolidated lawsuit is pending in the Superior Court of Washington, County of Pierce.
The consolidated lawsuit alleged that the cybersecurity incident and data breach could have been prevented and occurred as a result of security failures. The lawsuit asserted claims for negligence, breach of implied contract, unjust enrichment, invasion of privacy, and violations of the Washington Consumer Protection Act, Washington Data Breach Notification Disclosure Law, and the Uniform Health Care Information Act. The defendant maintains there was no wrongdoing and disagrees with all claims and contentions in the lawsuit.
All parties attended mediation and agreed to accept the mediator’s proposal. The settlement agreement has been preliminarily approved by the court, and the final fairness hearing has been scheduled for January 29, 2027. Under the terms of the settlement, Washington Gastroenterology has agreed to establish a $4,600,000 settlement fund, from which attorneys’ fees and expenses, settlement administration and notice costs, and service awards for the class representatives will be deducted. The remaining funds will be used for benefits for the class members.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
All class members are entitled to claim two years of single-bureau medical record and credit monitoring services. In addition, a claim may be submitted for one of two cash payments. A claim may be submitted for reimbursement of documented, unreimbursed losses due to the data breach up to a maximum of $4,000 per class member. Alternatively, class members may choose to receive a pro rata cash payment, estimated to be $75 per class member. The alternative cash payment may be higher or lower depending on the number of claims received. Individuals wishing to opt out of the settlement or file an objection have until December 11, 2026, to do so. The deadline for submitting a claim is January 10, 2027.
