Class action lawsuit over 5.6M breached records at Yale New Haven settled for $18M

The Yale New Haven Health System has agreed to pay $18 million to settle a class action lawsuit stemming from a data breach it suffered earlier this year that impacted 5.6 million patients. 

Per the terms of the agreement with plaintiffs representing the victims, Yale New Haven denies any wrongdoing or negligence related to the incident. The March 8 cyberattack resulted in some of its IT systems being shut down and patient data being accessed in what has all the hallmarks of a ransomware attack. 

In a statement released in April, the health system said its EHR and patient portal were not affected. However, it confirmed that hackers “obtained copies of certain data,” which included names, contact information, dates of birth, medical record numbers, and more on patients. Because the EHR was not breached, sensitive details on patient care were not reported as compromised. 

All the same, the breach required notifications under the terms of the Health Insurance Portability and Accountability Act (HIPAA), and was reported to the federal government’s healthcare data breach tracker.

Yale New Haven operates five hospitals in Connecticut and is affiliated with Yale University. However, the incident was isolated to the health system and no other Yale entities mentioned any IT outage. 

Under the terms of the settlement, victims can seek reimbursement from the $18 million fund. According to court documents, it will cover legal fees in addition to all benefits for class members, defined as all “living individuals residing in the U.S. who were sent a notice of the data incident indicating their private information may have been impacted in the data incident.”