Des Moines Orthopaedic Surgeons agrees to settle data breach class action lawsuits

Iowa-based healthcare company Des Moines Orthopaedic Surgeons has agreed to settle three class action lawsuits related to a 2023 data breach that exposed the personal and healthcare information of more than 300,000 current and former patients.

The healthcare company, operating in central Iowa since 1955 and providing comprehensive orthopedic care, notified more than 300,000 current and former patients in February 2024 that a data security incident, which took place on  February 17, 2023, compromised their detailed personal and healthcare information.

In its letter to affected individuals, the healthcare practice said unauthorised actors succeeded in accessing certain internal systems and removed information associated with patients. Upon learning the issue, the DMOS commenced an investigation with help from external cyber security professionals and notified the FBI about the incident.

"On December 6, 2023, our extensive forensic investigation and manual document review discovered that, on or around February 15, 2023, certain files containing your personal information may have been accessed or removed from our network as a result of this incident," DMOS said.

According to HIPAA Journal, the compromised information included patients’ names, Social Security numbers, dates of birth, driver’s license numbers, state identification numbers, passports, direct deposit bank information, medical information, and health insurance information. DMOS said the incident, which occurred due to a mistake by a vendor, impacted 307,864 patients.

Earlier today, HIPAA Journal reported that the orthopaedic care company has agreed to settle three class action lawsuits that were filed in the aftermath of the data security incident. Affected patients have until March 23, 2026, to file their respective claims and are entitled to reimbursement of a maximum of $400 for ordinary out-of-pocket losses and a maximum of $5,000 in reimbursement for extraordinary losses. DMOS has capped the overall settlement payout at $1 million.

"Des Moines Orthopaedic Surgeons denies all claims of liability and wrongdoing; however, opted to settle the litigation to avoid the costs, expense, distraction, burden, and disruption to business operations from continuing with the litigation," HIPAA Journal reported.