Suncoast Skin Solutions Lawsuit: Settlement Payouts and Deadlines

The Suncoast Skin Solutions data breach settlement resolved a Florida class action over a July 2021 cyberattack that exposed patient information for tens of thousands of people. The parties agreed to an $825,000 fund, Judge Laura E. Ward granted final approval on October 1, 2024, and payments to eligible class members began on November 22, 2024. The claims window has closed.¹²

What the Breach Exposed

Suncoast discovered on July 14, 2021, that an unknown party had encrypted some of its systems. A forensic investigation concluded that October that an unauthorized actor had accessed certain files, and a preliminary review in November 2021 confirmed legacy patient data was compromised. Exposed information included names, dates of birth, Social Security numbers, clinical information, doctor’s notes, and other treatment records. The practice’s live Electronic Medical Record system was not involved.³

Suncoast reported to the U.S. Department of Health and Human Services’ Office for Civil Rights that 57,730 individuals were affected.⁴ At least one other source put the number closer to 76,000, but the HHS filing is the official count.

The Class Action

The lawsuit, Reardon et al. v. Suncoast Skin Solutions, Inc. (Case No. 23-CA-000317), was filed in 2023 in the Thirteenth Judicial Circuit in Hillsborough County, Florida, by lead plaintiffs Jeremy Reardon, Linda Potter, and Frankie Solomon. Morgan & Morgan and Turke & Strauss LLP served as settlement class counsel.²

The settlement class covered everyone whose personal information was compromised in the incident discovered on or about July 14, 2021, which generally meant current or former patients who received a breach notification letter. People who opted out, judicial officers and their staff, Suncoast’s officers and affiliates, and anyone found to have caused or aided the breach were excluded.⁵

What the Settlement Paid

Class members could claim three kinds of benefits from the $825,000 fund.

Reimbursement of up to $10,000 per person for documented, unreimbursed out-of-pocket losses fairly traceable to the breach. Eligible costs included identity theft or fraud losses, credit monitoring or freezing fees, notary and postage charges, and unpaid time off work. Losses had to occur on or after July 14, 2021, and involve the same type of personal information given to Suncoast.
Compensation for lost time spent dealing with the breach, at $25 per hour for up to four hours ($100 maximum). Claimants had to attest that at least one full hour was spent and that the time was not otherwise reimbursable.
Two years of “Medical Shield Complete” medical and credit monitoring, an upgrade from the 12-month IDX monitoring Suncoast first offered after the breach.

All payments were subject to pro-rata adjustment if total claims exceeded the fund. Class members without documented financial losses could receive a basic pro-rata share of any remaining money.¹⁵

Class counsel were permitted to request up to one-third of the fund in fees (about $275,000) plus up to $25,000 in costs, subject to court approval.⁵

Deadlines, Approval, and Payment

The deadline to opt out of or object to the settlement was July 19, 2024. Claims had to be submitted through SuncoastSettlement.com or postmarked by August 19, 2024. Judge Ward held the final approval hearing on October 1, 2024, by Zoom, and approved the settlement.⁵²

Payments to approved claimants began on November 22, 2024. Class members could choose Venmo, Zelle, PayPal, a virtual MasterCard, or a physical check.¹ The settlement is now closed to new claims.

Why Notification Came So Late

Patients did not receive mailed notices about the breach until December 6, 2022, roughly 17 months after Suncoast first discovered the intrusion. Between December 2021 and October 2022, the company ran a data-mining process to identify individuals and pinpoint what had been exposed for each one, finalizing the notification list on November 28, 2022. Breach notifications were also filed with state attorneys general in Iowa, Maryland, Vermont, and other states.³⁶

Cases That Are Not Part of This Settlement

Two other matters sometimes get pulled into search results about this breach but are not part of it. Espinal v. Suncoast Skin Solutions, Inc. (Case No. 6:25-cv-00476), filed March 18, 2025, in the U.S. District Court for the Middle District of Florida, was brought under the Americans with Disabilities Act, not as a data breach claim. Plaintiff Joshua Espinal voluntarily dismissed the case, and the court dismissed it with prejudice on June 2, 2025.⁷

A December 2020 HHS Office of Inspector General settlement for $2,320,118.88 involved “Suncoast Dermatology and Skin Surgery Center, P.A.” along with Dr. Ralph Massullo Jr. and Dr. William Welton III, over allegedly falsified patient records and upcoded Medicare claims. The OIG record contains no reference to Suncoast Skin Solutions, and the two appear to be separate entities.⁸

1
ClaimDepot. Suncoast Skin Solutions Data Breach Settlement
2
LawFold. Suncoast Skin Solutions Lawsuit
3
Iowa Attorney General. Suncoast Skin Solutions Breach Notification
4
DataGuidance. USA: Suncoast Notifies OCR of Data Security Incident
5
Suncoast Skin Solutions Settlement. Notice of Proposed Class Action Settlement
6
Vermont Attorney General. Suncoast Skin Solutions Data Breach Notice to Consumers
7
PACER Monitor. Espinal v. Suncoast Skin Solutions, Inc.
8
HHS Office of Inspector General. Suncoast Dermatology and Skin Surgery Center Settlement