Radiology Practice to Pay $3.4M-Plus to Settle Hack Lawsuit

A North Carolina radiology practice says it will pay more than $3.4 million to settle proposed class action litigation filed after hackers stole records belonging to 887,000 individuals, including information such as medical diagnoses and treatment.

See Also: The Healthcare CISO’s Guide to Medical IoT Security

Under the settlement, eligible class members may submit a claim for documented unreimbursed losses related to the incident for up to $5,000.

Eastern Radiologists is also funding a “common fund” of up to $3.2 million. That fund will be used to pay alternative pro rata cash payment for claims of undocumented losses – although plaintiff attorneys anticipate that roughly half of the fund will end up in with them after submitting claims for fees of $1.5 million plus $50,000 in expenses. The radiology practice, in business for seven decades, agreed to implement and maintain unspecified business practice changes and improvements to its data security measures.

A North Carolina superior court judge gave the settlement preliminary approval in July, telling any potential objectors they have until next Tuesday to file any opposition to the agreement.

A final court hearing for the settlement is set for Dec. 15.

The practice learned on Nov. 20, 2023 that patients’ information was stolen. Information compromised in the incident included names, physical addresses, Social Security numbers, phone numbers, dates of birth and health insurance account information. Stolen clinical information included medical history, diagnoses, treatment, dates of service, and provider names, exam and procedure information.

A consolidated lawsuit alleged the data breach was “a direct and proximate result” of Eastern Radiologists’ negligence and inadequate data security.

“Plaintiffs’ private information was stolen by hackers, posted on the darkweb and exposed to an untold number of unauthorized individuals,” the complaint reads.

Under the settlement, Eastern Radiologists denies the claims and any wrongdoing or liability.

Eastern Radiologists reported the incident to federal regulators on Feb. 29, 2024 as a hacking/IT incident involving a network server and affecting the protected health information of 886,746 patients.

The incident ranked as the 22nd largest of 739 major PHI breaches reported to the U.S. Department of Health and Human Services in 2024 (see: Major Health Data Breaches: How Trends Are Shifting).