FMC Health $2.15 Million Settlement for July 2022 Data Breach Privacy Claims

In July 2022, FMC Health (FMC Services LLC) suffered a cybersecurity incident that exposed sensitive information, including adults’ and children’s personally identifiable information and protected health data, affecting about 266,540 people. Individuals who received a notice about the breach may be eligible to participate in a class action settlement. The settlement provides possible cash payments—up to $5,000 for people who can document unreimbursed losses or an estimated smaller amount for those without documentation—as well as two years of medical and/or minor identity and data monitoring services through CyEx, such as credit or Social Security number monitoring, dark web scanning, and identity theft insurance. The lawsuit was filed because the plaintiffs alleged FMC Health failed to adequately safeguard patient data, leading to harms they argued included increased risk of misuse, privacy violations, and financial impacts. They pursued legal theories including negligence, breach of fiduciary duty, breach of implied contract, and unjust enrichment, claiming the company did not meet the standard of care for handling highly sensitive “personal health information.” While FMC Health denies wrongdoing, it agreed to settle $2.15 million to avoid the uncertainty and cost of continued court battles—an approach commonly used in data breach litigation when companies want to limit long-term exposure. Broader implications extend beyond FMC: similar class actions often hinge on whether a healthcare organization implemented “reasonable” security measures and responded appropriately, especially given industry expectations and legal requirements in the U.S. For example, healthcare providers in the U.S. typically must follow HIPAA’s Security Rule, which sets standards to protect electronic protected health information, and many also face state privacy laws requiring safeguards and breach notifications. As these cases proliferate, settlements like this one can shape how providers invest in cybersecurity, improve incident response, and document compliance, reminding patients that their medical and identity data are governed by both federal health privacy rules and state-level consumer protection obligations—an outcome the FMC settlement reflects as claimants can pursue compensation and monitoring while the company resolves the dispute without a finding of liability