Yale New Haven Health System Agrees to $18 Million Settlement

The Yale New Haven Health System (YNHHS) has consented to an $18 million settlement fund in response to a class action lawsuit stemming from a significant data breach. This breach allowed unauthorized access to sensitive patient information, prompting legal action. Last week, a federal judge granted preliminary approval for the settlement, which aims to address the concerns raised by affected individuals.

Although YNHHS denies any wrongdoing or liability regarding the data breach, it has agreed to establish the fund to cover legal fees and administrative costs for individuals impacted by the incident. According to the terms of the settlement, which was filed on September 10, 2023, affected patients may claim reimbursement of up to $5,000 for documented losses incurred due to the breach or choose a cash payment of approximately $100.

Details of the Data Breach

“We take our responsibility to safeguard patient information extremely seriously,” stated Carmen Chau, a spokesperson for YNHHS. She emphasized that the health system had robust cybersecurity protocols in place, aligned with industry standards. Chau noted that the swift actions taken by the team helped to contain the issue and ensure uninterrupted patient care while preventing access to sensitive clinical information.

The settlement fund will allocate around $6 million for attorney fees, while select class representatives will receive $2,500 service awards. The breach, which occurred in March, involved the theft of data such as demographic information, social security numbers, patient types, and medical record numbers. Importantly, YNHHS clarified at the time that no electronic medical records or financial account information were compromised during the incident.

Legal Action and Future Commitments

Following the breach, YNHHS provided a detailed explanation of the incident on April 11, 2023. On April 16, 2023, plaintiffs initiated a class action lawsuit against the health system, alleging that it failed to adequately protect private information and did not implement necessary industry standards to guard against cyberattacks. The lawsuit also claimed that YNHHS delayed informing patients about the breach.

In court documents, YNHHS has explicitly denied all liability and allegations of wrongdoing. The organization stated it agreed to the settlement to “avoid the further expense, inconvenience and distraction of burdensome and protracted litigation,” according to court records.

A final approval hearing for the settlement is set for March 3, 2026, in Bridgeport, Connecticut, where a federal judge will determine whether to grant final approval. A deadline for filing claims related to the settlement is established for January 19, 2026.

YNHHS has reiterated its commitment to enhancing data security measures moving forward. “We are continuously updating and enhancing our systems to protect the data we maintain and to help prevent events such as this from occurring in the future,” Chau stated.

With over 12,000 employees and 4,500 physicians associated with the institution, YNHHS remains a vital healthcare provider in the region. This settlement underscores the ongoing challenges healthcare organizations face in safeguarding patient information amidst increasing cyber threats.