Baptist Health Data Breach Settlement Gets First Nod
A class action lawsuit against Baptist Health Medical Center-Drew County has been resolved with a settlement that provides reimbursement for documented losses, compensation for lost time, and credit monitoring services.
Between August 22 and July 8, 2024, a cybercriminal actor had access to the computer systems of Baptist Health Medical Center-Drew County in Arkansas and acquired patients’ personal and protected health information. Data compromised in the incident included names, addresses, birth dates, diagnoses, treatment information, medical record numbers, and other information. The data breach was reported to the HHS Office for Civil Rights as involving the protected health information of 5,207 individuals.
A class action lawsuit was filed in the Pulaski County Circuit Court of Arkansas by plaintiff Latanya Frazier, which was followed by a second putative class action. The two lawsuits were consolidated into a single complaint – Latanya Frazier & Chanta Ringo v. Baptist Health – as they made similar claims. The consolidated lawsuit is pending in the Circuit Court of Lincoln County, Arkansas.
The lawsuit alleged that Baptist Health Medical Center-Drew County maintained patient data in a reckless manner, as information was stored on computer systems vulnerable to cyberattacks and there was insufficient monitoring for signs of intrusions. The lawsuit claimed the lack of appropriate safeguards and failure to follow industry-standard cybersecurity practices violated HIPAA. The lawsuit asserted claims for negligence, negligence per se, breach of implied contract, breach of fiduciary duty, unjust enrichment, and invasion of privacy.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Baptist Health Medical Center-Drew County denies wrongdoing and disagrees with all claims and contentions in the lawsuit, while the plaintiffs believe their claims are valid. All parties agreed to engage in negotiations to ensure an early resolution of the lawsuit, and an appropriate settlement was agreed upon that was acceptable to all parties. The settlement has recently received preliminary approval from the court, and the final fairness hearing has been scheduled for February 4, 2027.
Baptist Health Medical Center-Drew County has agreed to pay attorneys’ fees and expenses, settlement administration and notice costs, service awards for the two class representatives, and benefits for the class members. All class members are entitled to claim two years of single-bureau credit monitoring services, which include a $1 million identity theft insurance policy. Class members may also claim up to four hours of lost time at $20 per hour as compensation for the time spent responding to the data incident.
In addition, class members who incurred losses as a result of the incident may submit a claim for reimbursement of those losses. Up to $400 may be claimed as reimbursement for documented, unreimbursed ordinary losses incurred between April 22, 2024, and December 8, 2026. Individuals who experienced fraud or identity theft as a result of the incident may also submit a claim for reimbursement of documented, unreimbursed extraordinary losses up to $4,000 per class member. Individuals wishing to object to the settlement or exclude themselves must do so by November 9, 2026. The deadline for submitting a claim is December 8, 2026.
