Yale New Haven Health System Agrees to $18 Million Data Breach Settlement

The Yale New Haven Health System (YNHHS) has reached a preliminary agreement to establish an $18 million settlement fund in response to a class action lawsuit concerning a significant data breach. This breach allowed unauthorized access to sensitive patient information, prompting the legal action. A federal judge provisionally approved the settlement last week.

Although YNHHS denies any liability or wrongdoing connected to the incident, the health system will create the fund to address legal fees and administrative costs incurred by affected individuals. According to the settlement, filed on September 10, 2023, impacted patients can claim reimbursement of up to $5,000 for documented losses related to the breach or choose a cash payment of approximately $100.

“We take our responsibility to safeguard patient information extremely seriously,” stated Carmen Chau, a spokesperson for YNHHS. “YNHHS had thorough cybersecurity protocols in place in alignment with industry-wide best practices. Due to our team’s quick action to identify and contain this issue, we were able to maintain uninterrupted patient care and prevent access to patients’ clinical information.”

Details of the Settlement

In addition to the $18 million settlement fund, the agreement includes provisions for “injunctive relief in the form of meaningful data security measures.” Approximately $6 million of the settlement will be allocated for attorney fees, while selected class representatives will receive $2,500 service awards.

The breach, which occurred in March 2023, exposed various data elements, including demographic information, social security numbers, patient types, and medical record numbers. YNHHS clarified that no electronic medical records or treatment information were compromised, nor was any financial account or payment information involved.

On April 11, 2023, YNHHS provided a more comprehensive report on the incident. Shortly thereafter, on April 16, 2023, plaintiffs filed the class action lawsuit, alleging that YNHHS failed to adequately protect the private information it collected. They claimed the health system did not meet industry standards for data security, which could have prevented the breach, and that there was a delay in notifying patients of the incident. In court documents, YNHHS has “denied all liability and all allegations of wrongdoing of any kind.”

The health system indicated that it opted for the settlement to “avoid the further expense, inconvenience and distraction of burdensome and protracted litigation,” as stated in court records.

Next Steps and Commitment to Security

The final approval hearing for the settlement is scheduled for March 3, 2026, in Bridgeport, Connecticut. A federal judge will determine whether the settlement should be officially approved, and affected individuals must file their claims by January 19, 2026.

Looking ahead, YNHHS has reaffirmed its commitment to enhancing its data security measures. “We are continuously updating and enhancing our systems to protect the data we maintain and to help prevent events such as this from occurring in the future,” Chau added.

Established as a significant healthcare provider, Yale New Haven Hospital employs over 12,000 individuals and collaborates with around 4,500 university and community physicians, according to information available on the hospital’s website. This settlement reflects the ongoing challenges health systems face in safeguarding sensitive patient data in an increasingly digital landscape.