Innovative Renal Care Pays $900,000 to Settle Data Breach Litigation
American Renal Management LLC, doing business as Innovative Renal Care, a kidney care specialist with more than 200 locations in 28 U.S. states, identified a cyberattack in February 2024 involving the theft of patient data. The data breach sparked multiple lawsuits, which were consolidated – In re American Renal Management LLC Data Breach Litigation – in the U.S. District Court for the Middle District of Tennessee. A $900,000 settlement has recently been proposed to resolve the litigation.
The data breach that sparked the litigation was identified on February 29, 2024. The forensic investigation determined that its network had been accessed by an unauthorized third party between February 21, 2024, and March 1, 2024, and files containing patient information were copied. The files contained a wide range of personal and protected health information, including names, contact information, birth dates, Social Security numbers, driver’s license numbers, financial account information, health insurance information, billing and claims information, medical information, and more.
The affected individuals started to be notified on February 14, 2025, almost a year after the intrusion was first identified. The HHS was notified on April 29, 2024, using a placeholder figure of at least 501 affected individuals. That total has not been updated since it was initially reported. According to the lawsuit, the defendant notified 59,400 living individuals that they had been affected.
The consolidated complaint names five plaintiffs, who allege that the defendant was at fault for the cyberattack due to the failure to implement reasonable and appropriate cybersecurity measures. The lawsuit also claims that the defendant unreasonably delayed issuing notification letters, depriving the affected individuals of the opportunity to take steps to protect themselves against identity theft and fraud. The lawsuit asserted claims for negligence, negligence per se, breach of implied contract, invasion of privacy, unjust enrichment, and violations of the California Consumer Privacy Act and California Unfair Competition Law.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Innovative Renal Care denies all claims and contentions in the lawsuit, including wrongdoing and liability; however, mediation was successful, and a settlement was agreed. The $900,000 settlement fund will be used to pay attorneys’ fees and expenses, settlement administration costs, service awards for the class representatives, and the remainder will be used to pay benefits to the class members.
Class members may submit a claim for reimbursement of up to $5,000 for documented, unreimbursed losses due to the data breach and/or claim a pro rata cash payment, estimated to be $100 per class member but may be higher or lower depending on the number of claims submitted. The deadline for opting out of the settlement and filing an objection is November 20, 2026. Claims must be submitted by December 21, 2026, and the final fairness hearing has been scheduled for February 1, 2027.
