Hypertension Nephrology Associates (HNA) based in Willow Grove, Pennsylvania made a decision to pay $625,000 to resolve a class action litigation that resulted from a data breach in January 2024. HNA discovered unauthorized system access on February 6, 2024 after finding a ransom note. A ransomware actor accessed its system and stole the personal data and protected health information (PHI) of 39,491 individuals, which include medical and fiscal data. HNA sent breach notification letters to the affected patients on May 17, 2024.
HNA is facing a lawsuit filed by plaintiff Patricia Kidwell in the Court of Common Pleas of Montgomery County, Pennsylvania. The Kidwell v. Hypertension Nephrology Associates, P.C. lawsuit alleged that the cyberattack and data breach happened because the defendant failed to use suitable security measures violating the HIPAA Security Law. The lawsuit likewise stated that the defendant did not identify the attack for two weeks and then deferred sending notification letters for three months, violating the HIPAA Breach Notification Law. An HIPAA training is definitely necessary to address HNA’s compliance with the regulations. HNA provided the affected patients free credit monitoring services for 12 months, which the plaintiff said was insufficient.
The lawsuit stated claims of breach of implied contract, negligence, negligence per se, invasion of privacy, and unjust enrichment. HNA does not agree with all the claims and denies any wrongdoing. After the filing of the lawsuit, the plaintiff and defendant decided to look into the chance of ending the litigation early. After mediation, they agreed on a settlement that was fair to both parties.
HNA will create a $625,000 settlement fund to pay for lawyers’ fees and expenditures, class representative awards, and settlement management expenses. What is left of the fund will be spent on class members’ benefits. Every class member may file a claim to reimburse documented, unreimbursed out-of-pocket expenses up to $5,000. Otherwise, class members can file a claim for a non-recurring cash payment. The amount of the cash payment will be based on the number of eligible claims submitted. Whatever the option selected, all class members could also get credit monitoring and insurance services for two years. The last day to file a claim is January 20, 2026. The schedule of the final fairness hearing is February 18, 2026.
