Yale New Haven Health System Agrees to $18 Million Data Breach Settlement

The Yale New Haven Health System (YNHHS) has reached a preliminary settlement of $18 million in response to a class action lawsuit stemming from a data breach that exposed patient information. A federal judge gave preliminary approval to the settlement last week, despite YNHHS denying any liability or wrongdoing related to the incident.

As part of the settlement, YNHHS will establish a fund to cover legal fees and administrative costs for those affected by the breach. According to documents submitted on September 10, 2023, impacted patients can seek reimbursement of up to $5,000 for documented losses or choose a cash payment of approximately $100.

In a statement, YNHHS spokesperson Carmen Chau emphasized the organization’s commitment to safeguarding patient information. “We take our responsibility to safeguard patient information extremely seriously,” she said. Chau noted that YNHHS had “thorough cybersecurity protocols in place” and that the health system’s rapid response helped maintain uninterrupted patient care during the breach.

The settlement also includes provisions for “injunctive relief in the form of meaningful data security measures.” Approximately $6 million from the fund will be allocated to attorney fees, while select class representatives will receive service awards of $2,500 each.

The breach occurred in March 2023, during which an unauthorized party accessed sensitive data, including demographic information, social security numbers, patient types, and medical record numbers. However, YNHHS assured that electronic medical records and treatment information were not compromised, nor was any financial account information involved.

On April 11, 2023, YNHHS provided a detailed account of the breach and was subsequently met with legal action. The class action lawsuit, filed on April 16, 2023, alleged that YNHHS failed to adequately protect private information and did not adhere to industry standards for data security. Plaintiffs also claimed that the health system delayed notifying patients about the breach.

Court documents reveal that YNHHS “denies all liability and all allegations of wrongdoing of any kind.” The health system stated that it opted for the settlement to avoid the “further expense, inconvenience and distraction of burdensome and protracted litigation.”

A final approval hearing for the settlement is scheduled for March 3, 2026, in Bridgeport, Connecticut, where a federal judge will decide whether to formally approve the terms. The deadline for affected individuals to submit claims is January 19, 2026.

Looking ahead, YNHHS has expressed its commitment to enhancing data security measures. Chau reiterated the organization’s ongoing efforts, stating, “We are continuously updating and enhancing our systems to protect the data we maintain and to help prevent events such as this from occurring in the future.”

With over 12,000 employees and 4,500 university and community physicians, Yale New Haven Hospital plays a significant role in healthcare provision in the region, making the protection of patient data a critical priority.