Highland Health Systems Agrees to $650,000 Settlement Over 2023 Data Breach
Highland Health Systems agreed to create a $650,000 fund to settle a class action lawsuit stemming from a July 2023 data breach that affected the sensitive information of patients and employees.
The company identified a security incident in early July 2023 involving the access and theft of sensitive patient data by hackers. The compromised information included names, contact information, birth dates, Social Security numbers, tax IDs, account numbers, payment card details, medical records, medical insurance information, and other sensitive data.
The affected individuals received breach notifications about the data breach on June 13, 2024. The data breach report submitted to the HHS’ Office for Civil Rights indicated that the electronic protected health information (ePHI) of 83,543 individuals were affected.
Two class action lawsuits were filed in response to the data breach. The lawsuits were combined into a single action, Weyerman, et al. v. Highland Health Systems et al. filed in the Circuit Court for Calhoun County, Alabama. The lawsuit names Highland Health Systems, CEO Mickey Turner, and Director of Finance Allen Stokes as defendants.
The lawsuit claims that the data breach resulted from the defendants’ negligence and could have been prevented if the the nonprofit health system implemented appropriate cybersecurity measures. The lawsuit asserted claims for breach of express and/or implied contract, negligence/negligence per se, wantonness, breach of fiduciary duty, unjust enrichment, and breach of confidence.
The defendants denied the claims and contentions in the lawsuit and sought dismissal of the case. The court rejected the motion to dismiss in its entirety.
$650,000 Settlement Agreement
Subsequently, all parties accepted the negotiated settlement agreement. Highland Health Systems has agreed to establish a $650,000 settlement fund that will cover litigation costs, attorneys’ fees, settlement management costs, and benefits for class members.
Class member benefits include a two-year membership to a medical identity protection service and a choice between two cash payment options. Class members may submit a claim for reimbursement of documented, unreimbursed expenses of up to $5,000 per class member. Alternatively, a one-time pro rata cash payment may be claimed. The expected pro rata payment is $85 per class member. The payment may be higher or lower depending on how many valid claims submitted.
Class memebers may object or opt out of the settlement until September 28, 2026. Claims must be submitted by October 28, 2026. The final approval hearing is scheduled for November 30, 2026.