Aspire Health Alliance Agrees to Settle 2023 Data Breach for $400,000
South Shore Mental Health Center, Inc., doing business as Aspire Health Alliance, has agreed to set up a $400,000 settlement fund to resolve class action litigation associated with a September 2023 cybersecurity incident that affected 17,490 individuals.
September 2023 Cybersecurity Incident
Aspire Health Alliance is a state-designated community behavioral health center with facilities in Quincy, Marshfield, and Braintree in Massachusetts. The organization detected unauthorized network access on September 13, 2023.
Aspire Health Alliance confirmed that an unauthorized third party accessed and acquired files containing patient information. The information included names, birth dates, dates of service, medical insurance information, condition or treatment data, Medicaid/Medicare numbers, and patient account numbers. Aspire Health Alliance patients started receiving notifications about the data breach as required under HIPAA laws on April 26, 2024.
Class Action Litigation
On May 10, 2024, a class action lawsuit was filed in the Superior Court of the Commonwealth of Massachusetts, Norfolk County. The case was subsequently moved to the Superior Court of the Commonwealth of Massachusetts, Suffolk County.
The Joan Tozzi v. South Shore Mental Health Center, Inc. d/b/a Aspire Health Alliance lawsuit claimed that the data breach could have been avoided if Aspire Health Alliance did not fail to implement reasonable and appropriate cybersecurity measures.
The lawsuit asserted claims for negligence, unjust enrichment, breach of implied contract, and breach of fiduciary duty. Aspire Health Alliance does not admit any wrongdoing or liability. However, the parties agreed to settle the litigation to avoid further legal costs and the uncertainty associated with a trial and related appeals.
Under the settlement terms, Aspire Health Alliance will set up a $400,000 settlement fund. The fund will cover class member benefits, attorneys’ fees and expenses, settlement management costs, and a class representative service award.
Class members are entitled to receive CyEx Medical Shield medical data monitoring service for one year. Eligible class members may also submit a claim for one of two cash payment options. One option provides reimbursement for documented, unreimbursed losses up to $2,500 per class member. The second option provides a pro rata cash payment. The value of that payment will depend on the number of valid claims received.
The deadline for class members to submit a claim, object to the settlement, or opt out is September 16, 2026. The final fairness hearing is scheduled for October 1, 2026.