OP Pharmacy, LLC, also known as OnePoint Patient Care, LLC, has agreed to establish a $2,115,000 settlement fund to resolve litigation arising from a 2024 data breach that affected the protected health information (PHI) of 1,741,152 individuals.
OnePoint detected the security incident on August 8, 2024. Hackers gained access to systems containing protected health information and copied files from the company’s network between August 6 and August 8, 2024. The data security breach affected approximately 528,000 patients. OnePoint mailed notification letters to affected individuals in October and November 2024.
Consolidated Lawsuit
Two lawsuits were filed in response to the data breach. The cases were consolidated because they contained overlapping claims. The consolidated lawsuit, Christopher Russo v. OP Pharmacy, LLC a/k/a OnePoint Patient Care, LLC, was filed in the District Court for the Western District of Kentucky, Louisville Division.
The lawsuit alleged that OnePoint willfully, recklessly, or negligently maintained patient data. The allegations included claims that the company failed to implement appropriate cybersecurity measures, such as HIPAA encryption, and did not maintain systems free of vulnerabilities.
The lawsuit asserted claims for unjust enrichment, negligence, negligence per se, breach of fiduciary duty, breach of implied contract, and declaratory and injunctive relief.
OnePoint disagreed with the claims and contentions asserted in the lawsuit. The parties eventually agreed to a settlement to avoid the costs and risks associated with a trial and related appeals.
Settlement Agreement
OnePoint will establish a $2,115,000 settlement fund to pay for the attorneys’ fees and expenses, settlement management costs, and class representatives’ service awards. The remaining funds will be used for class member benefits.
Eligible class members have two options to claim payment. They can choose to reimburse documented, unreimbursed losses up to $3,500 each, or they can get paid roughly $100 or pro rata cash payment. The cash payments may increase or decrease on a pro rata basis depending on the number of valid claims received.
As part of the settlement, OnePoint has agreed to implement additional security measures intended to reduce the risk of similar breaches in the future.
The last day for filing exclusion and opting out of the settlement is on August 24, 2026. The deadline for submitting a claim is October 8, 2026. The final fairness hearing is scheduled for September 23, 2026.
Image credit: 2094804463 – Suhaeni, AdobeStock / logo©OnePointPatientCare
