Lamoille Health Partners Settles Class Action Data Breach Lawsuit for $540,000
Lamoille Health Partners, a Vermont health system serving patients in Lamoille County, has agreed to settle a lawsuit that was filed in response to a June 2022 ransomware attack in which the protected health information of 59,381 patients was exposed and potentially stolen. Hackers gained access to the Lamoille Health Partners network between June 12, 2022, and June 13, 2022, and used ransomware to encrypt files. The attack exposed names, addresses, dates of birth, Social Security numbers, health insurance information, and medical treatment information. The affected individuals were notified about the breach in August 2022 and individuals who had their Social Security numbers exposed were offered complimentary identity protection and credit monitoring services.
A lawsuit – Marshall v Lamoille Health Partners Inc. – was filed in the U.S. District Court for the District of Vermont on September 1, 2022, in response to the breach that alleged Lamoille Health Partners was negligent by failing to implement reasonable and appropriate cybersecurity measures and follow security best practices. The lawsuit also alleged there was an unnecessary delay in notifying the affected individuals and that Lamoille Health Partners was not compliant with the HIPAA Rules. The lawsuit claimed the plaintiff, Patricia Marshall, and the class faced an imminent and ongoing risk of identity theft and fraud due to their sensitive information being in the hands of cybercriminals.
Lamoille Health Partners has not admitted to any wrongdoing and disagrees with the claims; however, a settlement was proposed to bring the legal action to an end. Under the terms of the proposed settlement, a $540,000 fund will be created to cover claims from individuals who were affected by the breach. Class members can submit claims of up to $5,000 to cover unreimbursed, documented out-of-pocket expenses incurred as a result of the breach, including bank fees, credit expenses, travel expenses, costs of credit monitoring services, and unauthorized charges. In addition, all class members will be entitled to a pro-rata payment which will be distributed after attorneys’ fees and legal costs have been deducted and claims have been paid. The payment is anticipated to be around $50 per class member.
Important Dates:
- Deadline for exclusion/objection: May 30, 2024
- Deadline for submitting claims: June 20, 2024
- Final approval hearing: September 30, 2024
