The 21st Century Oncology data breach lawsuit ended in June 2021 with a $12.5 million class action settlement covering roughly 2.2 million cancer patients whose personal and medical information was exposed in a 2015 hack. Eligible patients could claim two years of identity theft protection, up to $260 for time spent responding to the breach, and up to $10,000 in documented out-of-pocket losses. The claims deadline was May 10, 2021, and the case is closed.1Keller Rohrback L.L.P. 21st Century Oncology Data Breach2Top Class Actions. 21st Century Oncology Customer Data Breach Class Action Settlement
What Happened in the Breach
On or around October 3, 2015, an unauthorized person accessed a 21st Century Oncology database holding patient names, Social Security numbers, insurance details, diagnoses, treatment information, and the names of treating physicians.3HIPAA Journal. 21st Century Oncology 2.2 Million Hacking Incident The company did not catch the intrusion itself. The FBI told 21st Century Oncology about the breach on November 13, 2015, more than five weeks after the initial access, and asked the company to delay notifying patients so the investigation could continue.4News-Press. Data Breach Affects 2.2M 21st Century Oncology Patients
Patients weren’t told until March 4, 2016, when the company filed a disclosure with the SEC and began mailing notices.5ClassAction.org. Delucchi v. 21st Century Oncology Complaint The FBI believed patient data had been illegally obtained; 21st Century Oncology said it had found no evidence confirming any theft.3HIPAA Journal. 21st Century Oncology 2.2 Million Hacking Incident
The Consolidated Class Action
Lawsuits started arriving within weeks of the March 2016 disclosure. In October 2016, the Judicial Panel on Multidistrict Litigation combined sixteen separate actions from Florida and California into one proceeding, In Re: 21st Century Oncology Customer Data Security Breach Litigation, Case No. 8:16-md-2737, before Judge Mary S. Scriven in the U.S. District Court for the Middle District of Florida in Tampa.6Angeion Group. Class Action Settlement Agreement and Release
The consolidated complaint alleged that 21st Century Oncology failed to secure the sensitive data patients had given it and failed to encrypt personal and medical information, leaving people exposed to identity theft, fraudulent tax returns, and medical fraud.1Keller Rohrback L.L.P. 21st Century Oncology Data Breach
What the Settlement Paid
The parties filed a settlement agreement on August 12, 2020, and the court granted preliminary approval that November.6Angeion Group. Class Action Settlement Agreement and Release7Motley Rice. 21st Century Oncology Data Breach Settlement The deal carried a total value of $12.5 million, including a $7.85 million compensation fund for class members and up to $3.75 million in attorneys’ fees.2Top Class Actions. 21st Century Oncology Customer Data Breach Class Action Settlement
The settlement class covered approximately 2,213,597 U.S. residents who received a postcard notice that their information may have been compromised.6Angeion Group. Class Action Settlement Agreement and Release8ClassActionRebates.com. 21st Century Oncology Settlement Class members who filed claims could receive three kinds of benefits:
- Two years of identity theft protection through Identity Guard, with the option to defer enrollment for up to two years.7Motley Rice. 21st Century Oncology Data Breach Settlement
- Reimbursement for lost time at $20 per hour, up to $40 without documentation (two hours) or up to $260 with documentation (thirteen hours).2Top Class Actions. 21st Century Oncology Customer Data Breach Class Action Settlement
- Up to $10,000 for documented fraud losses and other out-of-pocket costs traceable to the breach.2Top Class Actions. 21st Century Oncology Customer Data Breach Class Action Settlement
Judge Scriven held the final fairness hearing on June 15, 2021, granted final approval, and entered final judgment on June 25, 2021.1Keller Rohrback L.L.P. 21st Century Oncology Data Breach2Top Class Actions. 21st Century Oncology Customer Data Breach Class Action Settlement
The Case Is Closed
The claims deadline was May 10, 2021. The settlement administrator has completed distribution, and no further claims are being accepted.1Keller Rohrback L.L.P. 21st Century Oncology Data Breach Anyone who missed the claims window has no route back into this particular settlement.
The Separate $2.3 Million HIPAA Penalty
The class action wasn’t the only payout tied to this breach. The U.S. Department of Health and Human Services Office for Civil Rights ran its own investigation and, in late 2017, reached a resolution agreement requiring 21st Century Oncology to pay $2.3 million.9U.S. Department of Health and Human Services. 21st Century Oncology Resolution Agreement
OCR found the company had not conducted an organization-wide risk assessment, had not done enough to reduce risks to patient data, and had not maintained proper procedures for reviewing system activity logs. The agency also cited the impermissible disclosure of protected health information for all 2,213,597 affected patients and the sharing of data with business associates without proper agreements in place.10HIPAA Journal. $2.3 Million 21st Century Oncology HIPAA Settlement Agreed With OCR That money went to the federal government, not to patients.
Why 21st Century Oncology No Longer Exists
The breach coincided with other serious problems at the company. On May 25, 2017, 21st Century Oncology filed for Chapter 11 bankruptcy in the Southern District of New York.11CNBC. Cancer Treatment Firm 21st Century Oncology Files for Bankruptcy The bankruptcy tangled the class action: the putative class of 2.2 million patients objected to the disclosure statement, arguing it failed to mention their breach-related claims.12Law360. Patients Fault Cancer Center Over Ch. 11 Plan Info Omissions The reorganization plan was confirmed on January 9, 2018, and the company emerged with $500 million less in debt.13GlobeNewsWire. 21st Century Oncology Receives Court Approval of Plan of Reorganization
In May 2020, GenesisCare completed its acquisition of the network, which by then included 293 locations and 123 radiation oncology centers across 15 states.14Simpson Thacher & Bartlett LLP. 21st Century Oncology Completes Sale to GenesisCare The 21st Century Oncology name has been retired.