Proliance Surgeons 4.45M Settlement Over 2023 Patient Data Breach and Identity Risk

A cyberattack discovered around Feb. 11, 2023 allegedly exposed sensitive patient and personal information held by Proliance Surgeons, a large Washington-based medical group, putting hundreds of thousands of patients at potential risk of identity theft and medical identity fraud (for example, someone using another person’s information to obtain care or bill insurers). Because healthcare organizations store high-value data—names, dates of birth, insurance and billing details, and sometimes clinical information—breaches can create long-tail harms that are difficult for individuals to detect or quickly reverse, which is why settlements often include monitoring services alongside cash payments. The class action was filed on the theory that Proliance failed to use reasonable safeguards and practices to protect patient data, asserting claims such as negligence, breach of implied contract, unjust enrichment, and violation of the Washington Consumer Protection Act; Proliance denies wrongdoing but agreed to a $4.45 million settlement to avoid litigation risk and deliver faster benefits. Eligible class members (about 437,392 people who received notice) can seek reimbursement of documented out-of-pocket losses up to $5,000, a pro rata cash payment (capped at $599 before adjustment based on claims and fees), and/or two years of medical identity-theft protection—an important remedy because medical identity issues can affect treatment records and insurance claims, not just credit. More broadly, this case fits a growing wave of healthcare data-breach class actions where plaintiffs argue that the “increased risk” of identity theft and time spent mitigating harm are real injuries warranting compensation, even when direct fraud isn’t immediately proven for every person. The regulatory backdrop includes HIPAA’s Security Rule (requiring administrative, physical, and technical safeguards for electronic protected health information) and Breach Notification Rule, plus state consumer-protection and data-breach notification laws that can sharpen liability exposure; together, they push providers and their vendors to improve security controls, incident response, and transparency because the financial and reputational costs of breaches increasingly extend beyond regulatory enforcement into large, multi-year settlement programs like this one