Yale New Haven Health System Settles Data Breach for $18 Million

The Yale New Haven Health System (YNHHS) has agreed to an $18 million settlement fund in response to a class action lawsuit stemming from a data breach that compromised patient information. A federal judge has recently given preliminary approval to this settlement, which aims to address the concerns of affected individuals and cover legal fees associated with the case.

While YNHHS denies any liability or wrongdoing related to the breach, the health system will allocate funds to support those impacted. Under the terms of the settlement, patients affected by the breach can claim reimbursement of up to $5,000 for documented losses or opt for a cash payment of approximately $100.

In a statement, YNHHS spokesperson Carmen Chau emphasized the organization’s commitment to protecting patient information. “We take our responsibility to safeguard patient information extremely seriously,” Chau noted. She added that YNHHS had implemented thorough cybersecurity protocols in line with industry standards and acted quickly to contain the issue, ensuring uninterrupted patient care.

Settlement Details and Implications

The settlement includes provisions for “injunctive relief” aimed at enhancing data security measures within YNHHS. Approximately $6 million of the settlement will be designated for attorney fees, while select class representatives will receive $2,500 service awards for their involvement in the case.

During the breach, which occurred in March 2023, an unauthorized party accessed sensitive data, including demographic information, social security numbers, and medical record numbers. However, YNHHS maintained that electronic medical records and treatment information were not compromised, nor was any financial account or payment information involved.

Following the breach, YNHHS provided a more detailed explanation to the public on April 11, 2023. Shortly thereafter, on April 16, 2023, plaintiffs filed a class action lawsuit, alleging that YNHHS had failed to protect private information adequately. They asserted that the health system did not implement necessary data security measures to prevent cyberattacks and claimed that YNHHS delayed informing patients about the breach.

In court documents, YNHHS denied all allegations of wrongdoing. The health system indicated that it opted for the settlement to avoid the burdensome costs and distractions of extended litigation. The final approval hearing for the settlement is scheduled for March 3, 2026, in Bridgeport, Connecticut. A federal judge will determine whether to grant final approval at that time. The deadline for affected individuals to file a claim is January 19, 2026.

Future Security Measures

Looking ahead, YNHHS has reaffirmed its commitment to enhancing data security protocols to prevent similar incidents in the future. Chau reiterated the health system’s dedication to ongoing improvements, stating, “We are continuously updating and enhancing our systems to protect the data we maintain and to help prevent events such as this from occurring in the future.”

With over 12,000 employees and approximately 4,500 affiliated physicians, Yale New Haven Health System plays a crucial role in providing healthcare services to the community. As the organization navigates this settlement, it aims to strengthen trust with its patients while addressing the challenges posed by cybersecurity threats.