Summit Medical Group decided to settle the class action lawsuit associated with a cybersecurity incident in November 2024 that exposed the personal data and protected health information (PHI) of over 464,000 patients and employees.
November 2024 Cybersecurity Incident
Summit Medical Group is an HIPAA-covered entity in Tennessee with more than 90 locations in Tennessee. The cybersecurity incident exposed information that included names, contact details, demographic data, provider names, medical record numbers, dates of services, facilities of service, treatment data, and/or medical insurance information.
The lawsuit alleged that the incident resulted from the lack of appropriate security measures and that breach notifications were not sent promptly. Summit Medical Group confirmed the exposure of patient data on September 19, 2024, but only sent breach notifications on March 2025.
Consolidated Class Action Lawsuit
Three putative class action lawsuits were filed in response to the data breach. Because the lawsuits’ claims and putative classes were similar, a consolidated Harris, et al. v. Summit Medical Group, PLLC lawsuit was filed in the Circuit Court for Knox County, Tennessee.
The lawsuit asserted claims for negligence, negligence per se, breach of implied contract, breach of fiduciary duty, unjust enrichment, and invasion of privacy. Summit Medical Group denied all of the claims.
Summit Medical Group filed a motion to dismiss the lawsuit. However, the parties later agreed to have litigation settlement because of the time, cost, and risks related to continued litigation. The court already gave preliminary approval of the finalized settlement terms.
Settlement Benefits for Class Members
The settlement provides medical data monitoring membership with CyEx Medical Shield Complete service for two years. Class members may file claims for refund of documented out-of-pocket expenses prompted by the data breach. The maximum reimbursement is $2,500 per class member.
Class members may also submit claims for reimbursement of up to three hours of lost time at $15 per hour. The maximum reimbursement for lost time is $45.
Cash payments under the settlement are capped at $500,000. If claims exceed that amount, the claims will be paid pro rata.
Summit Medical Group has also agreed to pay attorneys’ fees and expenses, settlement administration costs, and service awards for the class representatives.
Settlement Deadlines and Final Hearing
October 10, 2026 is the last day to object to and request exclusion from the settlement. Claims must be filed by November 4, 2026. The final fairness hearing is on November 19, 2026. The settlement remains subject to the court’s final fairness hearing.
Image credits: David 1956257450 AdobeStock / logo©SummitMedicalGroup
