Conway Regional Medical Center data breach $295K class action settlement

Conway Regional Medical Center in Arkansas has set aside $295,000 to resolve a class action lawsuit that alleged the hospital did not adequately protect information and exposed patients’ health and personal data to criminals in a breach. The hospital system maintains it has “meritorious” cyber defenses but has agreed to the settlement to bring an end to the litigation.

The class includes anyone who:

• Entrusted personally identifiable information or protected health information to Conway
• Had that information potentially accessible in the data breach
• Is not an affiliate, legal representative, attorney, heir, assign, officer, director or employee of the defendant or any entity in which the defendant has a controlling interest

As part of the settlement, class members are eligible for identity-protection services, up to $850 for documented economic losses they suffered as a result of the data breach and reimbursement for lost time with a claim showing the lost time is “fairly traceable” to the data breach.

Conway Regional Medical Center information exposed

The lawsuit alleges that on or about June 26, 2019, cybercriminals breached Conway Regional Medical Center’s data systems, exposing patients’ personal and health information. Social Security numbers, health insurance information and medical information may have been accessed in an email phishing attack, Little Rock ABC affiliate KATV reported.

Conway Regional Medical Center is a nonprofit regional medical system in northcentral Arkansas. 

Under the terms of the settlement, class members are eligible for identity-theft protection services and reimbursement of documented economic losses.

Class members have the option to sign up for two years of IDX Identity Protection Services. Class members may submit a form to enroll in the identity theft protection services and must activate the plan according to the instructions provided.

Class members may also submit claims for up to $850 in documented economic losses. However, the claimant must have elected and enrolled in the IDX Identity Protection Services provided by the settlement, submitted a reimbursement claim to IDX, had IDX deny the claim, and the class member has exhausted IDX’s claims process. 

Class members whose IDX reimbursement claim is rejected for failure to submit a claim within IDX’s required period may not submit a claim for reimbursement under this process. If the claim was denied because the class member failed to provide sufficient documentation, the loss may not be claimed for reimbursement under the settlement.

Claims for economic losses must include documentation such as bills or invoices showing the amount of the claim and proof these bills were paid; documentation showing the claim was submitted to and denied by IDX, and that the IDX claims process was exhausted; a signed statement indicating the losses are fairly traceable to the data breach; proof the total amount claimed has not been reimbursed; and, if applicable, a signed copy of Internal Revenue Service (IRS) Form 14039 and a statement that the form was submitted to the IRS.

Class members may make a claim for up to $40 for time lost dealing with the health data breach. Lost-time claims may be made regardless of whether the class member enrolls in the IDX protection or whether they make a claim for economic losses.

Class members who do nothing are automatically considered part of the settlement class, but if members do not fill out forms, they will not receive any portion of the settlement funds. Those who do nothing will also be giving up the right to sue regarding the data breach at issue.

Those who wish to be excluded from or object to the health data breach settlement may do so in writing by Dec. 21, 2022. Those who are excluded will not receive benefits but will not be bound by the terms of the settlement. 

A final fairness hearing is scheduled for Feb. 7, 2023.

The deadline to submit claim forms for reimbursement and to enroll in identity-theft protection is Feb. 20, 2023.

Who’s Eligible

The class includes anyone who:

• Entrusted personally identifiable information or protected health information to Conway
• Had that information potentially accessible in the data breach
• Is not an affiliate, legal representative, attorney, heir, assign, officer, director or employee of the defendant or any entity in which the defendant has a controlling interest

Potential Award

Up to $890

Proof of Purchase

Claims for economic losses must include documentation such as bills or invoices showing the amount of the claim and proof these bills were paid; documentation showing the claim was submitted to and denied by IDX, and that the IDX claims process was exhausted; a signed statement indicating the losses are fairly traceable to the data breach; proof the total amount claimed has not been reimbursed; and, if applicable, a signed copy of Internal Revenue Service (IRS) Form 14039 and a statement that the form was submitted to the IRS.

Claim Form

NOTE: If you do not qualify for this settlement do NOT file a claim.

Remember: you are submitting your claim under penalty of perjury. You are also harming other eligible Class Members by submitting a fraudulent claim. If you’re unsure if you qualify, please read the FAQ section of the Settlement Administrator’s website to ensure you meet all standards (Top Class Actions is not a Settlement Administrator). If you don’t qualify for this settlement, check out our database of other open class action settlements you may be eligible for.

Claim Form Deadline

02/20/2023

Case Name

Marshall, et al. v. Conway Regional Medical Center Inc., Case No. 23CV-20-771, in the Faulkner County Arkansas Circuit Court

Final Hearing

02/07/2023

Settlement Website

ConwayDataSettlement.com

Claims Administrator

Conway Data Settlement
PO Box 23309
Jacksonville, FL 32241
info@conwaydatasettlement.com
888-768-7138

Class Counsel

Lynn Toops
COHEN & MALAD LLP

J Gerard Stranch IV
BRANSTETTER STRANCH & JENNINGS PLLC

Christopher D Jennings
JOHNSON FIRM

Defense Counsel

William A Waddell Jr
FRIDAY ELDREDGE & CLARK LLP