McKenzie Health System Data Breach Settlement Up to $4,000 for Patient Records

In April 2025, McKenzie Memorial Hospital, doing business as McKenzie Health System, suffered a targeted cyberattack that potentially exposed sensitive patient information. Notices sent to affected people indicate the breach may have compromised the personal and protected health information of more than 58,000 individuals, including details such as dates of birth, Social Security numbers, and portions of medical records. For many patients, the worry doesn’t end at the hack itself—exposed data can be used for identity theft or fraud—so affected individuals were given the chance to seek recovery through a class action settlement. The lawsuit was filed by patients who alleged the hospital failed to adequately safeguard data before and during the attack, framing the case around the duty of healthcare organizations to protect sensitive information. Even though McKenzie Health denies wrongdoing, it agreed to settle to avoid the cost and uncertainty of further litigation, making the settlement significant because it offers compensation options and services without each person having to file a separate lawsuit. Claimants may seek reimbursement for documented out-of-pocket losses (up to $4,000) tied to the breach, or receive a simpler one-time payment if they don’t file for losses, and everyone can generally elect two years of credit monitoring and fraud protection, reflecting how courts and regulators increasingly treat data security failures as a consumer harm issue rather than a purely technical incident. Broader implications follow a familiar pattern in the healthcare industry: as hospitals and health systems digitize records, they must comply with safeguards under rules like HIPAA (the Health Insurance Portability and Accountability Act) and related guidance that require appropriate administrative, technical, and physical protections for protected health information. Similar class actions have emerged nationwide after breaches expose personally identifiable information and medical data, often leading to settlements that blend partial monetary recovery with credit monitoring, reflecting both the regulatory pressure on covered entities and the high risk of downstream fraud when highly sensitive data is compromised.