OrthoNY to pay $1.45m to settle class action lawsuit over breach of 656k patients' data

New York-based orthopaedic medicine and surgery practice OrthoNY has agreed to pay $1.45 million to settle a class action lawsuit over a 2023 data breach that impacted approximately 656,086 patients.

 

Formed in 2013 through the merger of Northeast Orthopaedics and Orthopaedic Associates of Saratoga, OrthoNY has offices spread across the state of New York, including in Albany, Clifton Park, Malta, Schenectady, Glens Falls, Delmar, and Saratoga Springs. The practice also runs a number of imaging centres and uses hospital affiliations to provide comprehensive care to patients.

 

The orthopaedic care practice suffered a serious ransomware attack in December 2023 that gave hackers access to its internal network and resulted in the loss of the personal and healthcare information of hundreds of thousands of patients. 

 

The practice notified the Office of the Maine Attorney General in January 2024 that the ransomware incident had compromised the personal and financial information of at least 177,276 individuals, including their names, Social Security numbers, drivers license information, payment information, dates of birth, medical record information, health insurance information, and treatment and diagnosis information.

 

The practice, then known as Northeast Orthopedics & Sports Medicine, said the compromised financial information included patients’ bank account numbers, credit and debit card numbers along with security codes, access codes, passwords and PINs. “In response to this incident, we worked with third-party specialists to re-secure our network, implement additional precautions, and we are reviewing our policies and procedures related to data protection,” it added.

 

According to HIPAA Journal, OrthoNY has now agreed to pay $1.45 million to settle a class action lawsuit over the ransomware incident in December 2023. The lawsuit, filed in the Circuit Court of the 17th Judicial Circuit in and for Broward County, Florida, alleged that OrthoNY failed to protect the sensitive personal and health information of as many as 656,086 patients.

 

OrthoNY agreed to pay the settlement amount considering the time and cost associated with protracted litigation and the uncertain outcome of the trial. The orthopaedic practice did not admit to any wrongdoing but said that the settlement serves the best interests of all affected patients.

 

The settlement figure of $1,450,000 will pay for attorneys’ fees and expenses, service awards for 12 class representatives, and other notification and administrative costs, and the remaining amount will be paid as benefits to class members.