Two Major Healthcare Data Breach Lawsuits Reach Settlement Agreements
Two healthcare-related organizations Omni Healthcare Financial Holdings and Western Montana Clinic have settled class action lawsuits stemming from separate data breaches that exposed sensitive patient information.
Omni Healthcare Financial Holdings Breach & Settlement
In January 2024, Omni Healthcare, a provider of financial services to healthcare organizations, suffered a cybersecurity incident involving unauthorized network access between January 18 and 19. The breach compromised the protected health information (PHI) of 16,852 individuals, including names, Social Security numbers, medical records, treatment details, and financial data. Despite detecting the breach in early 2024, affected individuals were not notified until April 2025 a 15-month delay with approximately 42,000 notifications sent.
Two lawsuits, filed in April 2025 by plaintiffs Latasha Hammond and Dawn Hairston, were consolidated in the Superior Court of Mecklenburg County, North Carolina. The suits alleged negligence, failure to comply with HIPAA standards, and inadequate cybersecurity measures. While Omni Healthcare denied wrongdoing, the parties agreed to a settlement to avoid prolonged litigation.
Under the terms, class members can receive:
- Three years of medical data monitoring
- Cash Payment A: Up to $5,000 for documented losses
- Cash Payment B: A $40 one-time payment
The final approval hearing is set for August 13, 2026, with a claims deadline of September 3, 2026.
Western Montana Clinic Breach & Settlement
Western Montana Clinic, a medical group in Missoula, MT, detected suspicious email activity on April 15, 2025, confirming unauthorized access to employee email accounts between March 11 and April 15, 2025. The breach exposed PHI of 8,255 individuals, with a total of 9,506 affected, including Social Security numbers, medical records, and treatment details. Notifications were sent on August 8, 2025.
A lawsuit, Murphy v. Western Montana Clinic, was filed in the Fourth Judicial District of Montana, alleging negligence and insufficient cybersecurity protections. Though the clinic denied liability, it settled to avoid further legal costs and operational disruptions.
Class members may claim:
- One year of medical data monitoring
- Up to $60 for lost time (three hours at $20/hour)
- Up to $5,000 for documented out-of-pocket losses
The exclusion and objection deadline is August 17, 2026, with claims due by September 15, 2026, and a final fairness hearing on September 9, 2026.
Both settlements highlight the financial and operational consequences of delayed breach responses and alleged cybersecurity failures in the healthcare sector.
Source: https://www.hipaajournal.com/omni-healthcare-western-montana-clinic-data-breach-settlements/
Omni-Health cybersecurity rating report: https://www.rankiteo.com/company/omni-health-group
"id": "OMN1785940664",
"linkid": "omni-health-group",
"type": "Breach",
"date": "1/2024",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': '16,852',
'industry': 'Healthcare/Financial Services',
'location': 'North Carolina, USA',
'name': 'Omni Healthcare Financial Holdings',
'type': 'Healthcare Financial Services Provider'},
{'customers_affected': '8,255',
'industry': 'Healthcare',
'location': 'Missoula, Montana, USA',
'name': 'Western Montana Clinic',
'type': 'Medical Group'}],
'attack_vector': ['Unauthorized Network Access', 'Compromised Email Accounts'],
'customer_advisories': [{'advisory': 'Three years of medical data monitoring, '
'up to $5,000 for documented losses, and '
'a $40 one-time payment.',
'entity': 'Omni Healthcare Financial Holdings'},
{'advisory': 'One year of medical data monitoring, up '
'to $60 for lost time, and up to $5,000 '
'for documented out-of-pocket losses.',
'entity': 'Western Montana Clinic'}],
'data_breach': {'number_of_records_exposed': ['16,852', '8,255'],
'personally_identifiable_information': ['Names',
'Social Security '
'Numbers',
'Medical Records',
'Treatment Details'],
'sensitivity_of_data': 'High',
'type_of_data_compromised': ['Protected Health Information '
'(PHI)',
'Personally Identifiable '
'Information (PII)',
'Financial Data']},
'date_detected': ['January 2024', 'April 15, 2025'],
'date_publicly_disclosed': ['April 2025', 'August 8, 2025'],
'description': 'Two healthcare-related organizations, Omni Healthcare '
'Financial Holdings and Western Montana Clinic, have settled '
'class action lawsuits stemming from separate data breaches '
'that exposed sensitive patient information.',
'impact': {'brand_reputation_impact': ['Negative Publicity', 'Loss of Trust'],
'data_compromised': ['Protected Health Information (PHI)',
'Names',
'Social Security Numbers',
'Medical Records',
'Treatment Details',
'Financial Data'],
'identity_theft_risk': ['High'],
'legal_liabilities': ['Class Action Lawsuits',
'Settlement Payments'],
'operational_impact': ['Delayed Notifications',
'Legal Costs',
'Operational Disruptions'],
'payment_information_risk': ['High'],
'systems_affected': ['Network Systems', 'Email Accounts']},
'investigation_status': 'Settled',
'lessons_learned': 'Delayed breach responses and alleged cybersecurity '
'failures can lead to significant financial and '
'operational consequences, including class action lawsuits '
'and settlement payments.',
'post_incident_analysis': {'corrective_actions': ['Settlement Agreements',
'Compensation for Affected '
'Individuals'],
'root_causes': ['Inadequate Cybersecurity Measures',
'Delayed Detection and Response']},
'references': [{'source': 'Cyber Incident Description'}],
'regulatory_compliance': {'legal_actions': ['Class Action Lawsuits'],
'regulations_violated': ['HIPAA']},
'response': {'communication_strategy': ['Delayed Notifications']},
'title': 'Two Major Healthcare Data Breach Lawsuits Reach Settlement '
'Agreements',
'type': ['Data Breach', 'Unauthorized Network Access', 'Email Compromise']}