Hospital Español Auxilio Mutuo de Puerto Rico Settles Data Breach Lawsuit
A settlement has been agreed to resolve class action litigation against Hospital Español Auxilio Mutuo de Puerto Rico to resolve claims related to a 2023 cybersecurity incident and data breach. The incident that sparked the lawsuit was identified by the U.S. Department of Homeland Security (DHS). DHS notified Hospital Español on September 23, 2023, that a cybercriminal actor had likely breached its network. The investigation confirmed that its network had likely been compromised, although it was not initially clear whether patient data was involved.
A year later, on September 24, 2024, internal and external cybersecurity experts concluded that its network was compromised between August 2022 and September 2023 and that patient data was likely exfiltrated. Data compromised in the incident included names, contact information, health information, health insurance information, billing and claims information, Social Security numbers, and other government-issued ID numbers. Notification letters were mailed to the affected individuals on April 21, 2025, 575 days after the hospital learned from DHS that its network had likely been compromised.
The first class action lawsuit was filed on May 1, 2025. Additional plaintiffs were added to the lawsuit, and an amended complaint was filed – Jose A. Morales Rosario, et al. v. Hospital Español Auxilio Muto De Puerto Rico, Inc. – in the United States District Court for the District of Puerto Rico. The lawsuit alleged that Hospital Español failed to implement appropriate cybersecurity measures, was not effectively monitoring its network for intrusions, failed to adequately train its employees on cybersecurity, and did not issue timely notifications. When the notification letters were issued, the plaintiffs allege that Hospital Español obfuscated the nature of the data breach and the threat it posed.
The lawsuit asserted claims for negligence, negligence per se, breach of implied contract, unjust enrichment, invasion of privacy, breach of fiduciary duty, and declaratory judgment. Hospital Español sought to have the lawsuit dismissed as it maintains there was no wrongdoing and disagreed with the claims asserted in the lawsuit. All parties discussed the possibility of an early resolution to the litigation to avoid the costs and uncertainties of continued litigation. The terms of the settlement have now been agreed, and the settlement has received preliminary approval from the court. Under the terms of the negotiated settlement, Hospital Español agreed to pay attorneys’ fees and expenses, settlement administration and notice costs, and service awards for the class representatives.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
A $500,000 settlement fund will be established to provide monetary benefits to the class members. Those benefits are reimbursement of out-of-pocket expenses up to $2,500 per class member or an alternative cash payment, estimated to be $25 per class member. In addition to one of those two benefits, class members may also claim two years of credit and medical monitoring services. Hospital Español has also agreed to implement a range of data security measures to reduce the risk of similar incidents in the future. The deadline for opting out, objecting, and submitting a claim is December 21, 2026. The final fairness hearing has been scheduled for January 20, 2027.
