Omni Healthcare Financial Holdings and defendants Injury Finance, LLC, and Omni Healthcare Financial, LLC, have settled class action litigation involving a January 2024 cybersecurity incident that affected the protected health information of 16,852 individuals.
The cybersecurity incident involved unauthorized network access of Omni Healthcare between January 18 and January 19, 2024. Omni Healthcare is a provider of financial solutions to healthcare organizations and patients.
Information exposed in the incident included names, contact details, birth dates, medical record numbers, diagnosis and treatment details, treatment costs, provider names, and Social Security numbers.
Omni Healthcare mailed approximately 42,000 notifications to affected individuals. The individuals whose protected health information (PHI) was involved in the incident were notified in April 2025, 15 months after discovering the breach.
On April 16, 2025, Latasha Hammond filed the first class action lawsuit and Dawn Hairston subsequently filed a second lawsuit in the District Court for the Western District of North Carolina. The lawsuits were consolidated under Hammond et al. v. Omni Healthcare Financial Holdings et al., with two additional plaintiffs added to the consolidated litigation.
Later, the litigation was transferred to the Superior Court of Mecklenburg County, North Carolina, where it is pending. The consolidated lawsuit alleged that the data breach could have been prevented if the defendants had implemented appropriate industry-standard cybersecurity measures and complied with the HIPAA Privacy Rule and HIPAA Security Rule.
The lawsuit claims breach of implied contract, negligence and negligence per se, and unjust enrichment. The defendants denied the claims and contentions in the lawsuit, including allegations of wrongdoing, fault, and liability.
Settlement Terms
The parties determined that a settlement would avoid further legal costs and the uncertainties associated with a trial and related appeals.
The defendants will cover attorneys’ fees and expenses, settlement administration costs, service awards for class representatives, and benefits for class members. Eligible class members can enroll in three years of medical data monitoring and medical identity theft services. Class members can also submit a claim for one of two cash payments:
- Cash Payment A provides reimbursement for documented, unreimbursed losses attributed to the data breach, up to $5,000 per class member.
- Cash Payment B provides a one-time cash payment of $40 per class member.
The final approval hearing is scheduled for August 13, 2026. The claims deadline is September 3, 2026.