Bone & Joint Clinic Settles Ransomware Class Action Lawsuit for $575,000
Bone & Joint Clinic S.C. has agreed to pay $575,000 to settle a class action lawsuit stemming from a January 2023 security incident that affected 105,094 current and former patients and employees.
Bone & Joint is an orthopedic and pain management clinical practice in Northcentral Wisconsin. On January 16, 2025, a security incident was identified that caused network disruption. An unauthorized third party accessed its network, used ransomware to encrypt files, and may have obtained protected health information such as names, contact information, dates of birth, Social Security numbers, health insurance information, diagnoses, treatment information, and other sensitive data.
Lawsuits were filed by four Bone & Joint Clinic patients, which were consolidated into a single complaint – Keith Tesky, et al. vs. Bone & Joint Clinic, S.C., – in the U.S. District Court for the Western District of Wisconsin. The lawsuits claimed that the practice failed to implement reasonable and appropriate safeguards to protect sensitive employee and patient data. The consolidated lawsuit asserted claims of negligence, negligence per se, breach of fiduciary duty, breach of implied contract, invasion of privacy, unjust enrichment, unfair and deceptive business practices, and a violation of Wisconsin law, which prohibits the unauthorized release of healthcare information.
Bone & Joint Clinic denies any wrongdoing and maintains there is no liability; however, a settlement was agreed to avoid the burden and expense of litigation. Under the terms of the settlement, class members may submit a claim for reimbursement of documented, unreimbursed out-of-pocket losses fairly traceable to the data breach up to a maximum of $5,000 per class member.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Class members may also submit a claim for a pro rata cash payment, which is expected to be $75, but may be higher or lower depending on the number of valid claims received. The cash payments will be paid from the remainder of the settlement after attorneys’ fees (up to $191,475), attorneys’ expenses (up to $20,000), service awards (up to $2,000 for each of the four named plaintiffs), and settlement administration costs have been deducted.
The deadline for exclusion from and objection to the settlement is September 15, 2025. Claims must be submitted by October 15, 2025, and the final fairness hearing has been scheduled for January 7, 2025.
