Oklahoma Spine Hospital Settles Data Breach Lawsuit for $1.1M

Oklahoma Spine Hospital decided to pay $1,100,000 to resolve a class action lawsuit arising from a data breach in July 2024 that impacted approximately 39,000 present and past patients. The hospital discovered a potential email account breach on or about July 1, 2024. According to the forensic investigation, an unauthorized individual potentially stole sensitive patient data and protected health information (PHI), which includes first and last names, birth dates, financial account numbers, payment card details, driver’s license data, medical insurance details, and medical data. The data breach impacted 38,945 present and past patients.

In response to the data breach, one class action lawsuit was filed on November 15, 2024 in Oklahoma District Court of Oklahoma County. Another lawsuit with similar claims was filed, and so combined with the first lawsuit into one complaint – In re: Oklahoma Spine Hospital Data Breach Lawsuit. The lawsuit stated claims of negligence, negligence per se, breach of fiduciary duty, breach of implied contract, and unjust enrichment. Oklahoma Spine Hospital rejects all liability and wrongdoing associated with the lawsuit.

All parties consented to negotiate the lawsuit, seeing that the litigation would possibly be prolonged and costly, and to steer clear of the uncertainty of a trial and corresponding appeals. Oklahoma Spine Hospital consented to create a $1,100,000 settlement fund to pay for attorneys’ fees and expenditures, service awards for the six plaintiffs, and settlement management and notification expenses. What is left of the fund will be for the class members’ benefits.

Class members can claim single-bureau credit monitoring services for three years, including an identity theft insurance policy worth $1 million, dark web scanning, and detailed public records tracking. Each class member can also file a claim to refund documented, unreimbursed losses as a result of the data breach up to $10,000.

Every class member could likewise claim a one-time cash payment. The remaining funds will be divided pro rata among the class members’ cash payments, which is estimated to be about $100, but could be more or less depending on how many valid claims submitted. The court has given preliminary approval of the settlement. Claims should be submitted on or before January 7, 2026. The schedule of the final approval hearing is February 17, 2026.

About Christine Garcia 1256 Articles
Christine Garcia is the staff writer on Calculated HIPAA. Christine has several years experience in writing about healthcare sector issues with a focus on the compliance and cybersecurity issues. Christine has developed in-depth knowledge of HIPAA regulations. You can contact Christine at [email protected]. You can follow Christine on Twitter at https://twitter.com/ChrisCalHIPAA