Scope
This guide outlines the legal and operational steps your organization must take when a data breach leads to class action litigation. You'll learn about the regulatory framework, timeline requirements, documentation standards, and strategic decisions that can mean the difference between a $475,000 settlement and a $15 million one.
Use this guide to build breach response plans, train incident response teams, or evaluate your current security posture against common negligence claims.
Key Concepts and Definitions
Class Action Settlement Fund: A court-approved pool of money covering legal fees, administrative costs, victim compensation, and service awards for named plaintiffs. For example, the Palomar Health Medical Group settlement established a $3.1 million fund after a breach affecting over a million people.
Fairness Hearing: The final court review ensuring a proposed settlement treats all class members fairly. Objections and opt-outs must be filed before this hearing. In the Palomar case, the deadline is October 7, 2026, with the hearing on November 6, 2026.
Negligence Claims: Allegations that your organization failed to implement reasonable security measures or respond appropriately to a known threat. These claims require evidence that you fell below the standard of care, not proof of intent.
Breach of Implied Contract: The legal theory that patients enter an unwritten agreement with your organization to protect their information when they share it for treatment. Courts increasingly recognize this as an actionable claim.
Requirements Breakdown
Federal Requirements
HIPAA Breach Notification Rule: Notify affected individuals within 60 days of discovering a breach affecting 500 or more people. Notification to OCR is immediate for large breaches. Palomar identified their breach on May 5, 2024, but didn't complete their investigation until September 4, 2025, a 16-month gap that plaintiffs can cite as evidence of inadequate incident response.
HIPAA Security Rule § 164.308(a)(1): Requires a risk analysis and risk management plan. Plaintiffs will request your most recent risk analysis during discovery to show you knew about vulnerabilities and didn't remediate them.
HIPAA Security Rule § 164.312(a)(2)(iv): Encryption is an Addressable Specification. If you don't encrypt ePHI at rest or in transit, you must document equivalent alternative measures. Lack of encryption plus no documented alternative equals negligence in most courts.
State-Level Requirements
California Consumer Privacy Act (CCPA): Applies to businesses with annual gross revenues exceeding $25 million or that handle data on 100,000+ California consumers. Plaintiffs in the Palomar case alleged CCPA violations alongside negligence claims.
California Confidentiality of Medical Information Act (CMIA): Requires healthcare providers to implement reasonable security measures and notify patients of breaches. Violations carry statutory damages that plaintiffs can stack on top of other claims.
Your state may have similar statutes with private rights of action. Check your jurisdiction before finalizing breach response procedures.
Implementation Guidance
Pre-Breach Prevention
Conduct quarterly access log reviews: Most breaches involve unauthorized access over days or weeks. Palomar's breach lasted 13 days before detection. Automated alerts for unusual access patterns can reduce that window.
Document your security decisions: If you choose not to implement an Addressable Specification, document why and what you're doing instead. This documentation is your defense against negligence claims. "We didn't have budget" isn't a defense; "We implemented network segmentation and intrusion detection as an alternative to full-disk encryption" is.
Test your incident response plan twice annually: Run tabletop exercises that include your legal team, PR, and IT. Time how long it takes to assemble the response team, assess scope, and draft notifications. Aim for 30-60 days maximum.
Post-Breach Response
Preserve all logs immediately: Once you detect a breach, implement a litigation hold on all system logs, access records, security tool outputs, and internal communications. Spoliation of evidence will destroy your defense.
Engage outside counsel within 24 hours: Privilege protections for your investigation findings depend on attorney work product doctrine. Have counsel direct the investigation so your findings aren't discoverable.
Notify faster than required: The Breach Notification Rule gives you 60 days. Aim for 30. Plaintiffs argue that delayed notification prevented victims from protecting themselves. Shorter notification windows undercut that claim.
Offer meaningful remediation: Credit monitoring is standard. Consider identity theft insurance, out-of-pocket expense reimbursement, or enhanced security training for affected individuals. The more robust your offer, the harder it is for plaintiffs to prove damages.
Common Pitfalls
Assuming your BAA protects you from vendor breaches: If your Business Associate causes a breach, you're still liable under HIPAA for selecting and monitoring them. Plaintiffs will argue you were negligent in vendor management. Maintain vendor risk assessments and proof of due diligence.
Waiting for investigation completion before notifying: You can send initial notification with partial information and update as you learn more. Palomar's 16-month investigation timeline before notification is indefensible.
Treating the settlement as the end: Even if you deny wrongdoing, the settlement is public record. Regulators, auditors, and HITRUST assessors will see it. Budget for enhanced controls and third-party audits post-settlement.
Underestimating state law exposure: HIPAA sets a floor, not a ceiling. State privacy laws often have lower thresholds for liability and allow statutory damages that multiply quickly. The Palomar plaintiffs cited both CCPA and CMIA violations.
Quick Reference Table
| Phase | Timeline | Key Actions | Documentation Required |
|---|---|---|---|
| Detection | Day 0 | Activate incident response team; implement litigation hold | Initial incident log with date/time of discovery |
| Assessment | Days 1-7 | Scope affected systems; identify data types; engage outside counsel | Forensic reports under attorney-client privilege |
| Notification | Days 8-30 | Draft and send individual notices; notify OCR if 500+ affected | Proof of mailing; website posting; media notice if 500,000+ |
| Investigation | Days 1-60 | Root cause analysis; identify vulnerabilities; document timeline | Investigation report; remediation plan |
| Remediation | Days 30-90 | Implement security enhancements; vendor reviews if applicable | Risk assessment updates; policy revisions |
| Legal Response | Ongoing | Respond to discovery; negotiate settlement; prepare for fairness hearing | All logs, policies, training records, vendor contracts |
Settlement Cost Factors:
- Number of affected individuals (Palomar: 1 million+)
- Types of data exposed (Palomar: SSNs, financial data, health information, credentials)
- Detection-to-notification delay (Palomar: 16 months)
- Evidence of prior knowledge of vulnerabilities
- Strength of your security program documentation
Your breach response starts before the breach happens. The organizations that settle for $475,000 instead of $15 million are the ones with documented risk analyses, tested incident response plans, and evidence they took security seriously before it became a legal problem.
