CaptureRx has offered to pay $4.75 million to resolve claims associated with a 2021 data breach that impacted roughly 2.4 million patients of its healthcare company customers.
CaptureRx is a medical care administrative service company that assists hospitals in managing their 340B drug discount programs. CapturRx discovered on February 6, 2021 that unauthorized persons had obtained access to its system and deployed ransomware to encrypt data files. On March 19, 2021, CaptureRx confirmed the compromise of files that contain patient information and began notifying impacted clients on March 30, 2021. CaptureRx publicly reported the data breach however failed to disclose the number of people impacted. In May 2021, it submitted the breach report to the HHS’ Office for Civil Rights indicating that 1,656,569 persons were affected, though a number of its healthcare company clients announced the breach on their own.
A number of class-action lawsuits were filed that claimed CaptureRX was negligent for not implementing and maintaining proper safety measures to secure patient information and other claims. CaptureRx decided to offer a settlement to take care of all claims related to the data breach to avert more legal expenses. CEO Christopher Hotchkiss of NEC Networks, CaptureRx’s parent company, stated CaptureRx is confronting several allegations for indemnity from its clients, which has put substantial financial stress on the provider. Hotchkiss mentioned CaptureRx isn’t a big national or multinational firm and has minimal resources. The settlement was offered to stop the lawsuit to avert more legal expenses. Hotchkiss explained in case the settlement is not accepted, CaptureRx may be compelled to file for bankruptcy.
The offered settlement will make sure the creation of a $4.75 million fund to pay for legal expenses and claims submitted by plaintiffs and class members. The plaintiffs’ lawyers will get about 33 % of the settlement, the plaintiffs will get about $2,000 each, and the rest of the fund will pay the claims by class members. CaptureRx’s insurance company will be paying approximately 50 % of the settlement, while CaptureRx will pay the rest. Plaintiffs are eligible to file claims as much as $25, irrespective of whether they encountered identity theft, with claims of around $75 allowed for California residents. As per the conditions of the settlement, CaptureRx must create, implement, and keep a complete information security program, in case such a system is not yet implemented.
CaptureRx is currently seeking the courts’ initial approval for the settlement deal and the plaintiffs will get the chance to turn down the settlement; nevertheless, attorneys for the plaintiffs think the offered settlement is reasonable.