Des Moines Orthopaedic Surgeons PC agreed to a proposed $1 million class action settlement after a February 2023 cybersecurity incident in which unauthorized access to its systems allegedly put patients’ sensitive information at risk—potentially including Social Security numbers and medical details. Healthcare providers are frequent targets for these attacks because they store “high-value” data that’s hard to change (unlike a password) and can be used for identity theft or medical fraud, and many clinics rely on complex networks of legacy software, vendors, and remote access tools that can widen exposure if security controls fall short. The lawsuit was filed by patients who claim the practice failed to implement reasonable data-security safeguards, leading to the exposure of private information and forcing affected people to spend time and money protecting themselves. While the practice denies wrongdoing, the settlement is significant because it offers a structured set of benefits—reimbursement for documented losses (up to $400 for ordinary expenses and up to $5,000 for extraordinary losses), compensation for time spent responding to the incident, an alternative cash payment, and three years of credit monitoring/identity theft protection—while also requiring additional security measures and creating a court-supervised claims process with deadlines for opting out and filing. More broadly, this case fits into a wave of healthcare data-breach class actions where plaintiffs argue that organizations should be held financially accountable when inadequate safeguards expose patient data, even if direct fraud hasn’t yet occurred. These disputes often revolve around industry expectations and regulatory frameworks such as HIPAA’s Security Rule (which requires covered entities to implement administrative, physical, and technical safeguards and to manage risks to electronic protected health information) and state breach-notification laws that trigger patient notices and, frequently, follow-on litigation seeking compensation and improvements to security practices.