Lincare Facing Class Action Lawsuit Over September 2021 Data Breach [UPDATE]
Last Updated on January 17, 2024
Kennedy v. Lincare Holdings Inc.
Filed: July 6, 2022 ◆§ 4:22-cv-03974
Lincare Holdings faces a proposed class action lawsuit over its alleged failure to safeguard certain sensitive information stored on its servers.
California
January 17, 2024 – $7.25M Lincare Data Breach Deal Approved; Settlement Website Is Live
Lincare has agreed to pay $7.25 million to resolve the lawsuit detailed on this page and nine related data breach cases, and the official settlement website can be found at LincareSettlement.com.
Want to stay in the loop on class actions that matter to you? Sign up for ClassAction.org’s free weekly newsletter here.
The deal, which was preliminarily approved by the court on December 15, 2023, covers anyone in the United States whose personal information was stored by Lincare and potentially disclosed, compromised or accessed as a result of the data breach experienced by the company in September 2021.
According to the settlement agreement, more than 2.3 million people received notice of the incident, though Lincare identified more than 552,000 others who were potentially impacted but who lacked a mailing address in the company’s systems or were deceased without a next-of-kin contact on file.
The settlement website shares that Lincare, as part of the deal, will pay $7,250,000 to be distributed among eligible class members who file a timely, valid claim. To receive a share of the settlement fund, a class member must submit a claim form online or by mail by April 15, 2024.
To submit a claim online, head to this page. Class members may also download the PDF claim form to file by mail. Per the website, filing a claim requires a Class Member ID, which can be found on the notice sent out by the settlement administrator.
As part of the relief offered by Lincare, any eligible class member may enroll in one year of identity theft protection and medical data monitoring services. In addition, class members who claim to have suffered reasonable, documented out-of-pocket losses as a result of the data breach will be entitled to reimbursement of up to $5,000 for damages that are “fairly traceable” to the incident, have not already been reimbursed, and were incurred since September 10, 2021.
Class members may also submit a claim for up to four hours of lost time spent remedying issues related to the data breach, at a rate of $20 per hour, the website adds.
“Out-of-Pocket Loss Claimants whose claims meet or exceed the $5,000.00 cap for Out-of-Pocket Losses are ineligible to seek relief for Lost Time,” the settlement website states. “Moreover, a Settlement Class Member cannot recover an aggregate amount of more than $5,000 for their combined Out-of-Pocket Loss Claim and Lost Time Claim.”
Per the website, class members who resided in California at the time of the incident can also make a claim for an additional cash payment of $90, on top of any other form of relief. All payments to class members will be increased or decreased on a pro rata basis, the website shares.
In addition to the aforementioned benefits, Lincare has also agreed to adopt and maintain certain enhanced data security measures to better protect patient data for a one-year period.
Records indicate that the plaintiffs notified the court of the settlement agreement with Lincare and filed an unopposed motion detailing the terms of the deal on October 6, 2023. The parties now await final approval of the settlement terms from United States Magistrate Judge Amanda Arnold Sansone.
A final approval hearing is scheduled for June 12, 2024. The website explains that payments will be distributed to eligible class members if the court grants final approval to the deal, and after any objections or appeals are resolved.
Don’t miss out on settlement news like this. Sign up for ClassAction.org’s free weekly newsletter here.
Lincare Holdings, Inc. faces a proposed class action lawsuit over its alleged failure to safeguard certain sensitive information stored on its servers.
Want to stay in the loop on class actions that matter to you? Sign up for ClassAction.org’s free weekly newsletter here.
The 36-page lawsuit centers on a cyberattack that supposedly began as early as September 10, 2021 and was discovered by Lincare, a medical equipment and services provider, on September 26 of that year. The case says that although Lincare claims to have discovered the breach on September 26, 2021 and blocked the unauthorized access by September 29, it did not begin to notify victims until June 2022, roughly nine months later.
Per the complaint, current and former patients’ medical treatment information, provider names, dates of services, diagnoses and procedures, account and/or record numbers, names and dates of birth were compromised in the incident. Lincare, the case claims, could have prevented the data breach by properly securing and encrypting its servers.
The lawsuit contends that Lincare was obligated under the Health Insurance Portability and Accountability Act (HIPAA) to satisfy at least the law’s minimum standards of care for organizations who deal with personal health information. More specifically, HIPAA requires organizations such as Lincare to maintain appropriate safeguards for the information with which it is entrusted, and sets limits and conditions on the uses and disclosures of the data that may be made without a customer or patient’s consent, the suit states.
According to the case, Lincare data breach victims remain in the dark regarding what particular data was stolen, the kind of malware used during the incident, and what steps are being taken, if any, to secure their information going forward.
“Representative Plaintiff and Class Members are left to speculate as to the full impact of the Data Breach and how exactly Defendant intends to enhance its information security systems and monitoring capabilities so as to prevent further breaches,” the filing reads.
The lawsuit looks to represent all individuals in the United States whose personal health and/or personally identifiable information was exposed to unauthorized third parties as a result of the Lincare data breach that occurred between September 10 and September 29, 2021.
Get class action lawsuit news sent to your inbox – sign up for ClassAction.org’s free weekly newsletter here.
Hair Relaxer Lawsuits
Women who developed ovarian or uterine cancer after using hair relaxers such as Dark & Lovely and Motions may now have an opportunity to take legal action.
Read more here: Hair Relaxer Cancer Lawsuits
Stay Current
Sign Up For
Our Newsletter
New cases and investigations, settlement deadlines, and news straight to your inbox.
Before commenting, please review our comment policy.