Jefferson-Blount-St. Clair Mental Health Authority has decided to create a $700,000 settlement fund to settle a consolidated class action lawsuit due to a November 2025 data security breach that likely exposed the personal data of staff members and protected health information (PHI) of 30,434 patients.
Unauthorized network activity was discovered on November 25, 2025. A forensic investigation established that a ransomware group gained access to Authority’s system on the same day and possibly stole employees’ personal data and patients’ PHI. The breached information included names, birth dates, medical insurance data, clinical data, billing or claims data, Medicare/Medicaid information, and Social Security numbers.
The incident led to several proposed class action lawsuits filed against JBS Mental Health Authority. The lawsuits claimed that the breach was Authority’s responsibility because of failure to employ proper cybersecurity measures and adhere to industry-standard guidelines.
The lawsuits became the consolidated Meyer, et al. v. Jefferson-Blount-St. Clair Mental Health Authority case filed in the Circuit , Court of Jefferson County, Alabama, Birmingham Division. The lawsuit claims the following: invasion of privacy, fraud, misrepresentation, negligence, negligence per se, breach of contract, breach of fiduciary duty, breach of confidence, unjust enrichment, inability to offer sufficient notice under federal and state notification regulations, breach of implied contract, breach of third-party beneficiary contract, bailment, and wantonness.
Jefferson-Blount-St. Clair Mental Health Authority denies the allegations and maintains that it committed no wrongdoing, but it agreed to a settlement.
Settlement Fund and Available Benefits
The proposed settlement creates a $700,000 fund. Attorneys’ fees and expenses, settlement management and notification fees, and service awards for class representatives will be taken from the fund. The rest of the fund will be allotted to class member benefits.
Eligible class members are provided with three years of credit monitoring and identity theft protection services. They may likewise submit claims for refund of documented, unreimbursed expenses associated with the data breach, up to $5,000 each.
Class members who don’t claim reimbursement may alternatively file for a cash payment of $100 each (this will be pro rated).
Eligible individuals are those living in the United States or its territories whose personal information was confirmed to have been likely impacted by the incident. This includes those who received a breach notification letter sent on March 9, 2026 as required by the HIPAA Breach Notification Law.
The last day to request exclusion from the settlement or submit an objection is November 23, 2026. The last day to file a claim is December 23, 2026. The final fairness hearing will be on February 16, 2027.
Image credit: 1453494099 BritCats Studio AdobeStock / logo©JBSMentalHealth
