Palomar Health Medical Group Agrees to $3.1 Million Data Breach Settlement
Palomar Health Medical Group decided to establish a $3,100,000 settlement fund to resolve class action lawsuit associated with a Spring 2024 cybersecurity breach that affected 1,140,221 individuals’ protected health information (PHI). The cybersecurity incident and data breach report was submitted to the U.S. HHS Office for Civil Rights (OCR).
Cybersecurity Incident Affected 1,140,221 Individuals
Palomar Health Medical Group is a non-profit healthcare organization serving patients at 20 locations in North San Diego County and South Riverside County in Southern California. The organization identified the cybersecurity incident on May 5, 2024. A forensic investigation determined that threat actors got access to its system from April 23, 2024, to May 5, 2024.
Information potentially stolen during the incident included names, contact information, birth dates, driver’s license numbers, Social Security numbers, state ID numbers, medical histories, medical data, medical insurance information, and other sensitive information.
PHMG faced several class action lawsuits after the announcement of the data breach. The lawsuits alleged that the incident could have been prevented and resulted from the failure to implement reasonable and appropriate cybersecurity measures. On September 16, 2024, the consolidated lawsuit, Castro et al. v. Arch Health Partners, Inc. d/b/a Palomar Health Medical GroupT, was filed in the Superior Court for the State of California, County of San Diego.
The consolidated lawsuit claims included invasion of privacy, negligence, negligence per se, and violations of the California Customer Records Act, California Confidentiality of Medical Information Act, and California Consumer Privacy Act. Palomar Health Medical Group does not admit to all claims and contentions in the lawsuit. Nevertheless, the parties agreed to settle the litigation to avoid the costs and risks associated with continued litigation.
Settlement Fund and Class Member Benefits
Based on the settlement terms, Palomar Health Medical Group must create a $3,100,000 settlement fund. Settlement management costs, attorneys’ fees and expenses, and service awards for the class representatives will be deducted from the fund. The remaining funds will be used to provide benefits to class members.
The settlement provides two years of free single-bureau credit monitoring services to all class members. Class members may either opt to reimburse documented, unreimbursed losses of up to $5,000 per class member. Or, they can apply for the alternative pro rata cash payment estimated at $60 per class member.
Settlement Deadlines
The last day to opt out of or object to the settlement is October 7, 2026. Claims need to be submitted until October 22, 2026. The final fairness hearing will be held on November 6, 2026. The settlement remains subject to the proceedings described in the approved source, including the scheduled final fairness hearing.