The Mednax data breach settlement is a $6 million class action resolution paid by Mednax Services, Inc. (now known as Pediatrix Medical Group, Inc.) to roughly 2.7 million people whose personal and medical information was exposed in a 2020 phishing attack on employee email accounts. A federal judge in the Southern District of Florida gave final approval on October 4, 2024, and payments to approved claimants went out in May 2025. The case is now closed.
What Happened in the 2020 Breach
On June 17 and June 22, 2020, unknown third parties gained access to several Microsoft Office 365 email accounts used by Mednax employees through a phishing attack. The intrusion was not fully investigated until November 2020, and affected patients were not notified until December 2020, roughly six months after discovery.
The exposed information included names, addresses, dates of birth, Social Security numbers, health insurance details, medical and treatment records, and billing information. Plaintiffs said Mednax offered little help with the aftermath. Some reported increased spam, identity theft, fraudulent bank accounts opened in their names, and personal information for sale on dark web marketplaces.
The breach reached patients of Mednax and of American Anesthesiology, Inc., which Mednax had sold to North American Partners in Anesthesia in May 2020 but was still supporting through a transitional email arrangement. The HIPAA Journal reported that the Mednax component affected about 1.29 million individuals and the American Anesthesiology component affected an additional 1.27 million patients.
Who Was Covered
The settlement class included all U.S. residents who received a notice in December 2020 or January 2021 stating that their personally identifiable information or protected health information may have been involved in the incident. The defendants named in the settlement were Pediatrix Medical Group, Inc. (formerly Mednax, Inc.), PMG Services, Inc. (formerly Mednax Services, Inc.), Pediatrix Medical Group of Kansas, P.C., and American Anesthesiology, Inc.
A total of 144 individuals opted out. No class members filed objections.
What Claimants Could Receive
The $6 million fund provided three types of benefits to class members who filed a valid claim by the September 9, 2024 deadline:
- Reimbursement of up to $5,000 for documented out-of-pocket losses from identity theft, fraudulent tax returns, credit monitoring costs, and related expenses incurred on or after December 16, 2020.
- Up to $420 for time spent responding to the breach.
- Three years of medical-fraud monitoring and protection services.
The fund also covered $1.8 million in attorney fees (30% of the fund), roughly $746,322 in litigation costs, and about $1.37 million in administration costs paid to Verita Global (formerly KCC Class Action Services), which served as the settlement administrator.
How the Case Reached Settlement
Multiple lawsuits filed after the breach were consolidated into a multidistrict litigation captioned In re: Mednax Services, Inc., Customer Data Security Breach Litigation, Case No. 21-MD-02994-RAR, in the U.S. District Court for the Southern District of Florida. The MDL was formed on June 4, 2021, and assigned to Judge Rodolfo A. Ruiz II. Eleven named plaintiffs served as class representatives, many of them parents or legal guardians filing on behalf of minor children. Class counsel included Federman & Sherwood and McShane & Brady, LLC, with a plaintiffs’ steering committee that included Morgan & Morgan, Fell Law PC, and other firms.
An early ruling in May 2022 found that plaintiffs had Article III standing because the actual misuse and unauthorized access of their data established a substantial risk of future harm, and that concrete intangible injuries such as disclosure of private information could support standing. After further motion practice, the parties negotiated the class-wide deal.
Key Dates
- June 17 and 22, 2020: Unauthorized access to Mednax email accounts.
- December 2020: Mednax begins notifying affected patients.
- June 4, 2021: MDL formed in the Southern District of Florida.
- April 10, 2024: Preliminary approval granted.
- September 9, 2024: Claims deadline.
- October 4, 2024: Final approval; Judge Ruiz found the settlement “fair, reasonable, and adequate.”
- May 2025: Payments distributed to approved claimants.
Current Status
With payments issued in May 2025, the case is closed. The claims window has passed, so new claims are no longer being accepted. Class members who submitted timely claims should have received their reimbursement, lost-time payment, or enrollment in the three-year medical-fraud monitoring service through the settlement administrator.