Gryphon Healthcare agreed to pay $2.87 million to settle a class action data breach lawsuit alleging exposed protected health information (PHI) following a July 2024 cyberattack.
Data Breach Incident Details
Gryphon Healthcare is a Houston, Texas-based revenue cycle, coding, compliance, consultancy, and management services vendor that was involved in a cyberattack impacting a partner organization it serves for medical billing services in July 2024.
Affected Data And Notifications
Files compromised in the incident contained PHI of 393,358 patients, including names, dates of birth, addresses, Social Security numbers, dates of service, diagnoses, treatment information, prescription data, medical record numbers, and health insurance information. Gryphon Healthcare began mailing notification letters to affected individuals on or around October 11, 2024.
Class Action Litigation
Multiple class action lawsuits were filed following the breach and were consolidated into a single complaint in the District Court for Harris County, Texas, titled Morris et al. v. Gryphon Healthcare, LLC. The consolidated lawsuit asserted claims including negligence, breach of contract, breach of fiduciary duty, invasion of privacy, unjust enrichment, and failure to provide adequate notice under applicable laws.
Settlement Terms And Deadlines
- Gryphon Healthcare denies liability but agreed to settle the litigation to avoid continued legal costs and uncertainty.
- Under the settlement, a $2,800,000 fund will cover attorneys’ fees, administrative costs, service awards to named plaintiffs, and benefits to class members.
- Class members may submit a claim for reimbursement of documented, unreimbursed losses up to a maximum of $5,000 per person, or choose a cash payment estimated at $100, subject to adjustment based on valid claims.
- All participating class members who submit a valid claim will also receive identity theft protection and medical data monitoring membership for two years with an identity theft insurance policy worth $1 million.
- The deadline to object or opt out is March 17, 2026, and the deadline to submit claims is April 16, 2026.
- The final fairness hearing is scheduled for August 31, 2026.