The Yale New Haven Health System (YNHHS) has reached an agreement to set up an $18 million settlement fund following a class action lawsuit concerning a data breach that compromised patient information. A federal judge granted preliminary approval for this settlement last week.
While YNHHS denies any allegations of wrongdoing, the health system will create this fund to assist with legal fees and administrative costs for those affected by the breach. According to the settlement submitted on September 10, impacted patients can claim reimbursement for documented losses up to $5,000 or choose a cash payment of around $100.
“We take our responsibility to safeguard patient information extremely seriously,” stated Carmen Chau, a spokesperson for YNHHS. “YNHHS had thorough cybersecurity protocols in place in alignment with industry-wide best practices, and due to our team”s quick action to identify and contain this issue, we were able to maintain uninterrupted patient care and prevent access to patients” clinical information.”
The settlement not only includes the $18 million fund but also mandates “injunctive relief in the form of meaningful data security measures.” Of the total settlement amount, approximately $6 million is designated for attorney fees, with select class representatives receiving $2,500 as service awards.
During the cybersecurity incident in March, an unauthorized entity accessed various data, including demographic details, social security numbers, patient types, and medical record numbers. However, a statement from YNHHS clarified that “YNHHS” electronic medical record and treatment information were not involved or accessed, and no financial account or payment information was involved in this incident.”
On April 11, YNHHS provided a more comprehensive overview of the breach, which subsequently led to a class action lawsuit filed by plaintiffs on April 16. The lawsuit accused YNHHS of failing to adequately protect the private information it collected and maintained and claimed the health system delayed notifying patients of the breach. In court documents, YNHHS has denied all liability and the allegations of any wrongdoing.
The health system indicated that it opted for the settlement to “avoid the further expense, inconvenience, and distraction of burdensome and protracted litigation.” The final approval hearing for the settlement is slated for March 3, 2026, in Bridgeport, Connecticut, where a federal judge will decide on the approval of the settlement. Claim submissions for the settlement must be filed by January 19, 2026.
Looking ahead, YNHHS has expressed its commitment to enhancing data security measures. “We are continuously updating and enhancing our systems to protect the data we maintain and to help prevent events such as this from occurring in the future,” added Chau.
According to its website, Yale New Haven Hospital employs over 12,000 individuals and collaborates with 4,500 university and community physicians.
