Jefferson-Blount-St. Clair Mental Health Authority Pays $700K to Settle Data Breach Lawsuit
Jefferson-Blount-St. Clair Mental Health Authority has agreed to settle a consolidated class action lawsuit stemming from a 2025 security incident that affected more than 30,000 individuals. Unauthorized network activity was identified on November 25, 2025, and its forensic investigation determined that a ransomware group accessed its network the same day and potentially obtained the personal information of employees and protected health information of 30,434 patients. Data compromised in the incident included names, Social Security numbers, health insurance information, dates of birth, medical information, Medicare/Medicaid information, and billing or claims information.
Multiple putative class action lawsuits were filed in response to the breach, alleging the defendant was responsible for the data breach due to a failure to implement appropriate cybersecurity measures and follow industry-standard best practices. The lawsuits were consolidated into a single action – Meyer, et al. v. Jefferson-Blount-St. Clair Mental Health Authority – which is pending in the Circuit Court of Jefferson County, Alabama, Birmingham Division.
The consolidated lawsuit asserted claims for negligence, negligence per se, breach of contract, breach of implied contract, breach of third-party beneficiary contract, breach of fiduciary duty, breach of confidence, invasion of privacy, fraud, misrepresentation, unjust enrichment, bailment, wantonness, failure to provide adequate notice, in violation of federal and state notification statutes. Jefferson-Blount-St. Clair Mental Health Authority disagrees with all claims and contentions in the lawsuit and maintains that there was no wrongdoing.
Jefferson-Blount-St. Clair Mental Health Authority agreed to a settlement to avoid the risk, delay, and uncertainty of continued litigation. Jefferson-Blount-St. Clair Mental Health Authority has agreed to establish a $700,000 settlement fund, from which attorneys’ fees and expenses, settlement administration and notification costs, and service awards for the class representatives will be deducted. The remainder of the settlement fund will be used to pay for class member benefits.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Class members are entitled to claim three years of credit monitoring and identity theft protection services. In addition, a claim may be submitted for reimbursement of documented, unreimbursed losses due to the data breach up to a maximum of $5,000 per class member. If a reimbursement claim is not submitted, class members may claim an alternative flat cash payment, estimated to be $100 per class member. The cash payments are subject to a pro rata increase or decrease.
Jefferson-Blount-St. Clair Mental Health Authority has also undertaken or will undertake changes to its business practices to ensure the security of its digital environment. The deadline for opting out and objection is November 23, 2026. Claims must be submitted by December 23, 2026, and the final fairness hearing has been scheduled for February 16, 2027.
