Bradford Health Services settles class action lawsuit over 2023 data breach

Bradford Health Services, an Alabama-based healthcare provider, has agreed to settle a class action lawsuit related to a data security breach it experienced in 2023.

 

Based in Birmingham, Alabama, Bradford Health Services is a leading rehabilitation care provider, offering a range of addiction treatment programs at 28 treatment facilities spread across the United States. Founded in 1977, the healthcare provider is best known for its substance abuse treatment and recovery and mental health and rehabilitation services.

 

In a data security incident notice, Bradford Health Services said it detected unusual activity on its internal network on December 8, 2023, and immediately launched an investigation with the help of external cybersecurity experts. 

 

The investigation found that certain files may have been accessed without authorisation. Following a review completed on May 15, 2025, the healthcare provider determined that the incident exposed certain individuals’ personal and protected health information.

 

The compromised data included names, Social Security numbers, driver’s license numbers, dates of birth, medical information (including diagnosis and treatment information, physician names, and Medical Record numbers), health insurance information, financial account numbers, passport numbers and payment card numbers.

 

According to HIPAA Journal, several class action lawsuits were filed following the cyber attack. The cases were later consolidated into a single lawsuit, In re Bradford Health Services, LLC Data Breach Litigation, in the Circuit Court of Jefferson County, Alabama, Birmingham Division. 

 

The plaintiffs alleged that the data breach resulted from the healthcare provider’s negligence in failing to implement reasonable and appropriate cyber security safeguards. The lawsuit brought claims of negligence and wantonness, negligence per se, breach of express or implied contract, and unjust enrichment.

 

After mediation in October 2025, all parties reached an agreement on the key terms of a settlement. The deal has since been finalised and received preliminary court approval.

 

As per the terms of the settlement, Bradford Health Services has agreed to cover attorneys’ fees, settlement administration and notice costs, service awards for class representatives, and benefits for class members. 

 

All class members are eligible for three years of medical data monitoring services and may also file claims for reimbursement of documented losses of up to $5,000 per person, or opt for an alternative cash payment estimated at around $150, subject to variation based on the number of claims filed.

 

The deadline to object or opt out is August 3, 2026, while claims must be submitted by August 17, 2026. The final fairness hearing is scheduled for September 1, 2026.