Physician Practices to Pay $50M to Settle Hack Lawsuits

A California-based network of nine affiliated physician practices has agreed to pay nearly $50 million to settle consolidated class action litigation involving a December 2022 ransomware and data theft attack that affected more than 3.4 million patients. Plaintiffs claimed their data was leaked on the darkweb.

See Also: The Healthcare CISO’s Guide to Medical IoT Security

The physician practices that are part of the settlement are all affiliates of Marina Del Rey, California-based Heritage Provider Network, one of the largest physician-owned and operated healthcare networks in the U.S., according to court documents.

Those practices include Regal Medical Group; Lakeside Medical Organization; Greater Covina Medical Group; Affiliated Doctors of Orange County Medical Group; Arizona Health Advantage; AZPC Clinics; Community Surgery Center of Glendale; Pacific Family Hospice; and Valley’s Best Hospice.

The $49.9 million settlement provides each class member with three years of complimentary identity and theft monitoring.

The settlement also provides each eligible class member that submits a claim a cash payment of up to $10,000 for documented fraud, out-of-pocket expenses and losses fairly traceable to the data breach, which will not exceed $2 million in total of the settlement fund.

The settlement also provides class members a cash payment of up to $210 for documented time dealing with the data breach, or up to seven hours valued at up to $30 per hour.

Seven class representatives are also set to each receive $7,500 service awards. Attorneys representing the plaintiffs and class members are seeking nearly $16.7 million in fees and expenses.

Each class member will also receive a pro-rated cash payment that will be based on the remaining net settlement fund after all the other payments and expenses have been paid.

A final hearing for the court to approve the settlement is slated for Jan. 28, 2026.

Breach Details

The Regal Medical hacking incident ranked as the 10th largest of 746 major health data breaches reported in 2023 to the U.S. Department of Health and Human Services.

A breach notice issued by Regal Medical and several of the other affiliated practices in February 2023 said the provider network became aware of the incident on Dec. 8, 2022, after noticing “difficulty” in accessing network servers (see: California Medical Groups’ Ransomware Breach Affects 3.3M).

“After extensive review, malware was detected on some of our servers, which we later learned resulted in the threat actor accessing and exfiltrating certain data from our systems.”

The physician network said it worked with third-party vendors to restore access to its systems and analyze the affected data.

Information compromised in the incident potentially includes the patient’s name, Social Security number, date of birth, address, diagnosis and treatment, laboratory test results, prescription data, radiology reports, health plan member number and phone number.

Lawsuit Allegations

The plaintiffs alleged among other claims that the defendants “failed to adequately protect this sensitive information, resulting in harm and risk of identity theft.”

The consolidated proposed class action litigation, which includes more than 25 lawsuits, also alleged that plaintiff and class member information has been publicly released on the internet and darkweb, which they claim will continue to pose “injury, damages and losses as a result.”

Regal Medical and all the other affiliated physician practice defendants in the litigation deny “any and all wrongdoing” under the settlement.

Regal Medical did not immediately respond to Information Security Media Group’s request for comment on the settlement and for additional details pertaining to the data breach, including the identity of the cybercrime group suspected in the incident and whether the physician practice network paid a ransom.

The Regal Medical settlement is among several class action settlements in recent weeks involving hacking incidents that resulted in major health data breaches.

In the past week, Integris Health, an Oklahoma healthcare network, agreed to pay $30 million to settle class action litigation involving a 2023 data theft hack that affected 2.4 million people. Some of the patients – including minors – have received blackmail demands directly from cybercriminals threatening to sell their data on the darkweb (see: Oklahoma Health System to Pay $30M to Settle Hack Lawsuits).

Also, ALN Medical Management, a Nebraska-based revenue cycle management firm, and Octapharma Plasma, a Swiss-based pharmaceutical manufacturer with blood plasma collection centers in the United States, recently acquired to respectively pay $4 million and $2.55 million to settle class action litigation involving each of their own 2024 hacking incidents (see: ALN, Octapharma Plasma Agree to Settle Breach Lawsuits).

Some legal experts contend that civil class action litigation filed in the wake of major data security incidents, resulting in multimillion-dollar settlements, is a much more likely scenario faced by healthcare sector entities, compared with federal regulatory scrutiny that’s less likely to result in expensive fines and corrective actions.