Des Moines Orthopaedic Surgeons Settlement Resolves Class Action Lawsuit Over February 2023 Data Breach

New to ClassAction.org? Read our Newswire Disclaimer

Des Moines Orthopaedic Surgeons has agreed to settle a class action lawsuit that alleged that the Iowa orthopedic practice failed to implement proper security measures to prevent a February 2023 data breach that supposedly exposed a significant amount of private patient information.

Don’t miss out on class action settlement news like this. Sign up for ClassAction.org’s free weekly newsletter.

The Des Moines Orthopaedic Surgeons class action settlement received preliminary court approval on November 25, 2025 and covers all living individuals who received a notice from the practice that their private information may have been affected by the February 2023 data breach.

Per settlement documents, approximately 300,000 individuals will be covered by the data breach settlement.

The court-approved website for the Des Moines Orthopaedic Surgeons class action settlement is available at DesMoinesOrthoDataIncident.com.

The settlement website conveys that settlement class members who submit a timely, valid claim form have multiple options for reimbursement. Those who submit with their claim form documented proof of extraordinary losses stemming from the data breach are eligible to receive a one-time cash payment of up to $5,000. Claims for extraordinary losses must include documentation that the class member made a reasonable effort to avoid or seek reimbursement for their losses and incurred expenses must not already be covered by any other reimbursement option, the agreement outlines.

The settlement site adds that class members who submit with their claim form documented proof of ordinary out-of-pocket losses stemming from the data breach are eligible to receive a one-time cash payment of up to $400. A non-exhaustive list of expenses covered by the ordinary loss category includes losses due to identity theft or fraud, unreimbursed bank fees, postage and fees for credit repair services.

Furthermore, class members may submit a claim for up to four hours of lost time spent responding to the data breach at a rate of $20 per hour. Class members seeking reimbursement for lost time must include a statement briefly describing their activities, the settlement agreement notes, and claims for lost time reimbursement may be combined with claims for ordinary out-of-pocket losses.

In place of any documented loss or lost time payouts, the site reports that class members may instead submit a claim for an alternative one-time cash payment of approximately $25.

In the event a class member’s Social Security number was compromised in the data breach, the settlement agreement details that the value of alternative cash payment will increase to approximately $100.

In addition to monetary reimbursement, all class members are eligible to enroll in three free years of three-bureau credit monitoring, according to the settlement site, which includes identity theft protection services.  

To submit a Des Moines Orthopaedic Surgeons claim form online, class members can visit this page and enter the claim number and PIN as found on their copy of the settlement notice. Alternatively, class members can download a PDF claim form to print, fill out, and return by mail to the address of the settlement administrator listed on the first page of the document.

All Des Moines Orthopaedic Surgeons settlement claim forms must be submitted online or postmarked by March 23, 2026.

Finally, as part of the settlement, Des Moines Orthopaedic Surgeons has agreed to implement certain cybersecurity business practice improvements, including new software security tools, to mitigate the risk of future data breaches.

A hearing to determine whether the court will grant final approval to the settlement will be held on April 2, 2026. Compensation will be distributed to class members only after final approval has been granted and any appeals have been resolved.

The Des Moines Orthopaedic Surgeons class action lawsuit claimed that the orthopedic healthcare provider suffered a data breach that allegedly exposed sensitive patient information between February 15, 2023 and February 17, 2023. According to court documents, the information compromised in the data breach included names, Social Security numbers, dates of birth, driver’s license numbers, passports, direct deposit bank information, medical records, and health insurance information. Head to ClassAction.org’s settlements page for a complete list of data breach settlements.