Tampa General Hospital agrees to $6.8 million settlement over cyberattack affecting 2.4 million patients

Tampa General Hospital has reached a $6.8 million settlement to resolve a class action lawsuit stemming from a significant cyberattack in 2023 that compromised the protected health information of over 2.4 million individuals. The settlement marks a resolution to allegations of negligence in cybersecurity practices, although the hospital denies any wrongdoing.

The breach, discovered on May 31, 2023, revealed that hackers had gained unauthorized access to Tampa General Hospital’s network from May 12 to May 30, 2023. During this period, cybercriminals exfiltrated sensitive patient data, including names, dates of birth, contact details, Social Security numbers, health insurance information, and limited treatment records. Initial reports estimated the breach impacted approximately 1.3 million patients, but subsequent investigations disclosed the actual number to be 2,430,920.

Following the breach, several class action lawsuits were filed, later consolidated into a legal action titled DiPierro et al. v. Florida Health Sciences Center Inc. d/b/a Tampa General Hospital in the 13th Judicial Circuit Court for Hillsborough County, Florida. Plaintiffs argued that Tampa General Hospital failed to implement adequate cybersecurity measures that could have prevented the breach. While the hospital maintains its systems were robust and denies liability, it opted for a settlement to avoid prolonged litigation and uncertainty at trial.

As part of the settlement, Tampa General Hospital will establish a $6.8 million fund to cover attorneys’ fees, legal expenses, reimbursement claims, and cash awards for impacted individuals. Patients notified about the breach can submit claims for documented losses or opt for a flat cash payment.

Class members who document their losses may claim up to $1,500 for ordinary losses, $7,500 for extraordinary losses, and compensation for up to four hours of lost time spent addressing the breach at $25 per hour. Alternatively, individuals can select a flat payment of $125. The final amount received may vary based on the number of claims filed. In addition, all class members will receive one year of complimentary three-bureau credit monitoring services.

The settlement has received preliminary court approval, and the deadline for objections and exclusions has passed. Affected individuals must submit their claims by January 12, 2025. A final approval hearing is scheduled for February 3, 2025.

The official settlement website provides more details about the settlement, including eligibility and claim submission.