Bone & Joint Clinic S.C. decided to resolve a class action lawsuit by paying $575,000. The lawsuit is associated with a security breach in January 2023 that had 105,094 affected patients and workers.
HIPAA-covered entity, Bone & Joint in Northcentral Wisconsin, offers orthopedic and pain management services. On January 16, 2025, the clinical practice experienced a security incident that resulted in system disruption. An unauthorized third party gained access to its system, deployed ransomware to encrypt files, and potentially stole protected health information (PHI), such as names, contact details, birth dates, Social Security numbers, diagnoses, treatment details, medical insurance data, and other sensitive information.
Four patients filed lawsuits against Bone & Joint Clinic, but the lawsuits were combined into one lawsuit, Keith Tesky, et al. vs. Bone & Joint Clinic, S.C., filed in the U.S. District Court for the Western District of Wisconsin. According to the lawsuit claims, the practice did not employ acceptable and proper safety measures to secure sensitive patient and worker information. The combined lawsuit filed breach of fiduciary duty, claims of negligence, negligence per se, invasion of privacy, breach of implied contract, unfair and deceptive business practices, unjust enrichment, and a violation of Wisconsin law, which forbids the unauthorized disclosure of healthcare data.
Bone & Joint Clinic does not admit to any wrongdoing or liability; nevertheless, the practice agreed to a settlement to steer clear of the hassle and cost of going to court. As per the terms of settlement, each class member could file a claim for refund of reported, unreimbursed out-of-pocket expenditures reasonably linked to the data breach up to $5,000.
Class members could file a claim for cash payment. The expected cash payment is $75, but it could be higher or lower, adjusted pro rata based on the number of eligible claims. The cash payments will be from the settlement fund after deducting attorneys’ fees (approximately $191,475), service awards ($2,000 per plaintiff), legal expenditures (around $20,000), and settlement management costs.
The last day to file an objection to or exclusion from the settlement is September 15, 2025. Claims should be filed on or before October 15, 2025. The schedule of the final fairness hearing is January 7, 2025.
Image credit: Zamrznuti tonovi, AdobeStock / logo©Bone&Joint
