Yale New Haven Health System Settles Data Breach Case for $18 Million

The Yale New Haven Health System (YNHHS) has agreed to establish an $18 million settlement fund following a class action lawsuit linked to a significant data breach. A federal judge recently gave preliminary approval for the settlement, which addresses allegations that unauthorized access occurred, compromising patient information.

Although YNHHS denies any wrongdoing, the settlement is designed to cover legal fees and administrative costs related to affected individuals. According to the settlement documents, filed on September 10, 2023, patients impacted by the breach may either seek reimbursement of up to $5,000 for documented losses or choose a cash payment of approximately $100.

YNHHS spokesperson Carmen Chau emphasized the organization’s commitment to safeguarding patient information, stating, “We take our responsibility to safeguard patient information extremely seriously.” She added that the health system had implemented thorough cybersecurity protocols aligned with industry best practices. “Due to our team’s quick action to identify and contain this issue, we were able to maintain uninterrupted patient care and prevent access to patients’ clinical information,” Chau noted.

Details of the Settlement and Breach

In addition to the monetary settlement, the agreement includes provisions for enhanced data security measures as part of “injunctive relief.” Approximately $6 million of the fund will be allocated to attorney fees, while select class representatives are set to receive $2,500 service awards.

The breach, which occurred in March 2023, involved the theft of sensitive data such as demographic information, social security numbers, and medical record numbers. However, YNHHS stated that electronic medical records and treatment information were not compromised, nor was any financial account or payment information involved in the incident.

On April 11, 2023, YNHHS provided a more detailed account of the breach. Shortly thereafter, plaintiffs filed a class action lawsuit on April 16, 2023, alleging that YNHHS failed to adequately protect private information and did not adhere to industry standards for data security. They also asserted that the health system delayed in notifying patients about the breach. In court documents, YNHHS denied all claims of liability and wrongdoing.

The health system explained its decision to settle was influenced by a desire to “avoid the further expense, inconvenience, and distraction of burdensome and protracted litigation,” according to court records.

Next Steps and Future Security Measures

A final approval hearing for the settlement is scheduled for March 3, 2026, in Bridgeport, Connecticut, where a federal judge will assess whether to finalize the settlement. The deadline for patients to file a claim is January 19, 2026.

YNHHS reiterated its dedication to improving data security measures moving forward. Chau stated, “We are continuously updating and enhancing our systems to protect the data we maintain and to help prevent events such as this from occurring in the future.”

With over 12,000 employees and 4,500 university and community physicians, YNHHS plays a vital role in the healthcare landscape, and its commitment to data protection will be closely scrutinized by both patients and regulatory bodies in the future.