Innovative Renal Care Agrees to $900,000 Settlement Over 2024 Data Breach
American Renal Management LLC, dba Innovative Renal Care, has agreed to a proposed $900,000 settlement to resolve class action litigation as a result of a February 2024 cyberattack that compromised the personal and protected health information (PHI) of patients and employees. The settlement remains subject to court approval. The In re American Renal Management LLC Data Breach Litigation is pending in the United States District Court for the Middle District of Tennessee under Case No. 3:25-cv-00248-EJR.
Details of the February 2024 Data Breach
Innovative Renal Care found unauthorized activity involving its computer systems on February 29, 2024. According to the investigation, an unauthorized third party accessed the company’s system from February 21, 2024 to March 1, 2024.
During the attack, the unauthorized party copied files containing patient information. The breached records included names, contact details, birth dates, driver’s license numbers, Social Security numbers, financial account details, medical insurance information, billing and claims data, and medical records. The incident also affected sensitive personally identifiable information (PII) belonging to current and former employees.
Innovative Renal Care sent the breach notification to the U.S. Department of Health and Human Services on April 29, 2024, initially identifying at least 501 affected individuals. That reported figure has not been updated. The company sent breach notifications to 59,400 living individuals about the breach. The company began notifying affected individuals on February 14, 2025, nearly one year after discovering the unauthorized access.
Class Action Lawsuit and Allegations
Multiple lawsuits were filed following the breach and subsequently consolidated into In re American Renal Management LLC Data Breach Litigation. The consolidated complaint identifies five plaintiffs who allege that Innovative Renal Care failed to implement reasonable and appropriate cybersecurity protocols to prevent unauthorized access to sensitive information. The plaintiffs also claim that sending delayed breach notifications to affected individuals prevented them from taking timely measures to address potential identity theft and fraud.
The lawsuit stated claims including violations of the California Unfair Competition Law and California Consumer Privacy Act, negligence, negligence per se, privacy intrusion, unjust enrichment, and breach of implied contract.
Innovative Renal Care denies the allegations, wrongdoing, and liability. The parties reached a proposed settlement following mediation. Under the proposed agreement, Innovative Renal Care will establish a $900,000 settlement fund to resolve the litigation. The fund will cover settlement management expenses, lawyers’ fees and expenses, service awards for class representatives, and benefits for class members.
Class members who submit valid claims may receive reimbursement of up to $5,000 for documented, unreimbursed monetary losses associated with the data breach. Eligible individuals may also request a cash payment estimated at $100, which could be higher or lower depending on the number of valid claims submitted and the funds available for distribution.
Settlement class members may additionally claim two years of credit monitoring services.
Individuals who received notification from Innovative Renal Care regarding the incident can submit a claim form until December 21, 2026. Forms can be submitted online or by mail postmarked no later than December 21, 2026.
The last day to request exclusion from the settlement is November 20, 2026. Class members who wish to object to the settlement must file their objections by November 20, 2026. The final fairness hearing will be on February 1, 2027.