NEW: A Better Approach to HIPAA Training
View HIPAA Courses
NEW: A Better Approach to HIPAA Training
View HIPAA Courses

The HIPAA Journal is the leading provider of HIPAA training, news, regulatory updates, and independent compliance advice.

Brockton Neighborhood Health Center to Pay Up to $850,000 to Settle Breach Lawsuit

Massachusetts-based Brockton Neighborhood Health Center has agreed to pay up to $825,000 to settle class action litigation over a 2024 cyberattack and data breach that affected 97,488 individuals. The data breach that sparked the lawsuits was identified on November 3, 2024. The forensic investigation confirmed that an unauthorized third party accessed its network between November 1 and November 3, 2024. That third party was a ransomware group called Interlock, which obtained files containing patient information such as names, addresses, dates of birth, diagnoses/conditions, lab test results, medications, other treatment information, medical record numbers, and health insurance information.

Multiple class action lawsuits were filed in response to the data breach, alleging that the data breach could have been prevented and occurred as a result of cybersecurity failures. The lawsuits were consolidated into a single complaint – Howard, et al. v. Brockton Neighborhood Health Center, Inc. – which is pending in the Plymouth County Superior Court for the Commonwealth of Massachusetts.

The consolidated lawsuit asserts claims for negligence, breach of implied contract, unjust enrichment, and invasion of privacy. Brockton Neighborhood Health Center maintains there was no wrongdoing and disagrees with all claims and contentions in the lawsuit. After weighing up the risks and uncertainties of continued litigation, all parties agreed to a settlement.

Brockton Neighborhood Health Center has agreed to pay attorneys’ fees and expenses, settlement administration costs, and service awards for the class representatives. An $850,000 settlement fund has been established to cover those costs and pay benefits to the class members. All class members may claim three years of credit monitoring services. A claim may also be submitted for reimbursement of documented, unreimbursed losses due to the data breach up to a maximum of $2,500 per class member. An alternative cash payment of up to $50 per class member may be claimed if a reimbursement claim is not filed.

Get The FREE
HIPAA Compliance Checklist

Immediate Delivery of Checklist Link To Your Email Address

Please Enter Correct Email Address

Your Privacy Respected

HIPAA Journal Privacy Policy

The settlement has received preliminary approval from the court. The deadline for objection is November 9, 2026, and claims must be submitted by December 8, 2026. The final fairness hearing has been scheduled for January 12, 2027.

Author: Steve Alder is the editor-in-chief of The HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered in The HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has 10 years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics. Steve shapes the editorial policy of The HIPAA Journal, ensuring its comprehensive coverage of critical topics. Steve Alder is considered an authority in the healthcare industry on HIPAA. The HIPAA Journal has evolved into the leading independent authority on HIPAA under Steve’s editorial leadership. Steve manages a team of writers and is responsible for the factual and legal accuracy of all content published on The HIPAA Journal. Steve holds a Bachelor’s of Science degree from the University of Liverpool. You can connect with Steve via LinkedIn or email via stevealder(at)hipaajournal.com

x

Is Your Organization HIPAA Compliant?

Find Out With Our Free HIPAA Compliance Checklist

Get Free Checklist