Jefferson County Health Department Pays $2.25M to Settle Data Breach Lawsuit
Jefferson County Health Department, a public health agency for Jefferson County in Hillsboro, Missouri, has agreed to settle class action litigation that was initiated in response to a 2022 data security incident.
The incident that sparked the litigation was identified on or around November 15, 2022. The forensic investigation determined that its network was accessed by an unauthorized third party between October 31 and November 15, 2022, who potentially viewed or obtained personal and protected health information such as names, dates of birth, Social Security numbers, driver’s license numbers, financial account information, medical information, and health insurance information. The data breach was reported to the HHS’ Office for Civil Rights on January 13, 2023, as involving the protected health information of 115,940 individuals.
The first class action lawsuit was filed on January 27, 2023, and was consolidated with a second complaint on October 2, 2023. The consolidated lawsuit – J.D., et al. v. Jefferson County Health Center d/b/a Jefferson County Health Department – is pending in the Circuit Court of the City of St. Louis, State of Missouri.
The consolidated lawsuit alleged that the plaintiffs would not have sought healthcare services from Jefferson County Health Center if they knew that their personal and health information would not be adequately protected. They claim that the failure to implement appropriate cybersecurity measures constituted negligence, breach of contract, breach of fiduciary duty, and violated the covenant of good faith and fair dealing. Jefferson County Health Department maintains that there was no wrongdoing and does not believe there is any liability or that there were any damages. A motion to dismiss the lawsuit was denied by the court, and a settlement was ultimately negotiated that was acceptable to all parties and avoids the cost and risks associated with a trial and related appeals.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Under the terms of the settlement, Jefferson County Health Department has agreed to establish a $2.25 million settlement fund, from which attorneys’ fees and expenses, settlement administration costs, and service awards for the three class representatives will be deducted. The remainder of the fund will be used to pay for benefits to the class members.
Class members may either submit a claim for reimbursement of documented, unreimbursed losses due to the data breach up to a maximum of $300 per class member, including up to three hours of lost time at $20 per hour. Individuals who do not submit a claim for reimbursement of losses and lost time may claim a one-time cash payment of $150. The deadline for exclusion from the settlement, objection, and submitting a claim is November 16, 2026. The final fairness hearing has been scheduled for December 10, 2026.
