The California Department of Corrections and Rehabilitation (CDCR) decided to resolve a class action lawsuit associated with negligence for not preventing a data breach in 2022. The data breach happened in January 2022 after hackers accessed CDCR systems comprising the protected health information (PHI) and personally identifiable information (PII) of people imprisoned in the State of California.
The breached data associated with the incident involved COVID-19 testing information from June 2020 until January 2022, and the mental health data of patients in the Mental Health Services Delivery System since 2008. Data in the Trust, Restitution, Accounting, and Canteen System (TRACS) was likewise possibly affected. There was no evidence suggesting data theft and it wasn’t feasible to say specifically what types of data were impermissibly viewed during the incident. The breach report submitted to the HHS’ Office for Civil Rights indicated that up to 236,000 individuals’ protected health information (PHI) was affected.
The Thomas, et al. v. California Department of Corrections and Rehabilitation, et al lawsuit claimed that CDCR enforced inadequate safety measures to avoid unauthorized access to prisoners’ information. The settlement of the potential HIPAA violation was suggested to prevent the risks and uncertainty linked to continuing litigation. CDCR did not acknowledge any liability or wrongdoing.
As per the terms of the settlement, CDCR will set aside a settlement fund. After deducting the attorneys’ service fees, legal costs, and expenditures, the remaining amount will be divided equally among all class members of the settlement. All persons who got a postcard notice concerning the settlement need not file a claim. They are going to be automatically issued their part of the settlement. Those who didn’t get a postcard notice, but are class members must file a claim to get their part of the settlement fund. The last day for filing claims is on February 14, 2025. The schedule of the final approval hearing is March 7, 2025.