Southern Ohio Health Systems Data Breach

The deadline to submit a claim form expired on December 21, 2022.




FREQUENTLY ASKED QUESTIONS





BASIC INFORMATION AND OVERVIEW

You received the Notice because the Bricker law firm previously sent you notice in April 2021 that your personal, medical, or financial information may have been compromised during the Incident. A Court authorized the Notice because you have a right to know how the proposed settlement may affect your rights. The Notice explains the nature of the litigation, the general terms of the proposed settlement and what it may mean to you. The Notice also explains the ways you may participate in, object to, or exclude yourself from, the Settlement.



On January 31, 2021, Bricker learned that it was the target of a ransomware attack. Upon learning of the incident, Bricker immediately took measures to contain the incident and launched an investigation, with the assistance of third-party cybersecurity forensic experts. Bricker also notified federal law enforcement.



The investigation determined that an unauthorized party gained access to certain Bricker internal systems at various times between approximately January 14, 2021 and January 31, 2021. Findings from the investigation indicate that the party obtained some data from certain Bricker systems during this period, including personal and medical data that Bricker had in its possession for purposes of providing legal advice to TriHealth, Inc. and Adena Health System (the “Health Systems”). Bricker was able retrieve the data involved from the unauthorized party and has taken steps to delete the data. Bricker has no reason to believe this data was further copied or retained by the unauthorized party. Bricker conducted a thorough review of the data to identify individuals whose personal or medical information may have been involved, and on or about April 11, 2021, provided notice of the incident to those persons. The notice offered those persons whose information was potentially compromised a complimentary one-year membership in Experian® IdentityWorksSM Credit 3B.



Thereafter, separate class action lawsuits were filed against the Health Systems by individuals who allege that they were affected by the Incident. The lawsuits have been consolidated in the Court of Common Pleas for Hamilton County, Ohio, under the caption In Re Southern Ohio Health Systems Data Breach Litigation, Case No. A2101886. The judge overseeing the case is the Honorable Jennifer Branch. The individuals who sued are called “Plaintiffs.” The Health Systems are the “Defendants.” Bricker will fund the settlement. Plaintiffs contend that the Health systems did not adequately protect their personal identifying information (“PII”) and protected health information (“PHI”). Plaintiffs assert claims including: (1) negligence; (2) negligent entrustment; (3) breach of implied contract; (4) unjust enrichment; and (5) vicarious liability. The consolidated complaint filed in the lawsuit, which describes the specific legal claims alleged by the Plaintiffs, is available here.



The Health Systems and Bricker deny any wrongdoing, and no court or other entity has made any judgment or other determination of any wrongdoing.



In a class action, one or more people called “class representatives” sue on behalf of themselves and other people with similar claims. All of these people together are the “class” or “class members.” Because this is a class action settlement, persons who did not file their own lawsuit can obtain relief from harm that may have been caused by the Incident, except for those individuals who timely exclude themselves from the Settlement Class (see FAQ 13).



The Court has not decided in favor of Plaintiffs or the Health Systems. Instead, both sides agreed to a settlement. Settlements avoid the costs and uncertainty of a trial and related appeals, while more quickly providing benefits to members of the Settlement Class. The class representatives appointed to represent the class and the attorneys for the Settlement Class (“Class Counsel,” see FAQ 11) believe that the Settlement is in the best interests of the Settlement Class Members.



WHO IS PART OF THE SETTLEMENT?

You are a member of the Settlement Class if your personal, medical, or financial information was potentially exposed in the Incident. Excluded from the Settlement Class are: (1) the judge presiding over this Action, and members of their direct families; (2) the Health Systems and Bricker, and each of their subsidiaries, parent companies, successors, predecessors, and any entity in which the Health Systems or Bricker or each of their parents have a controlling interest and their current or former officers, directors, and employees; and (3) Settlement Class Members who submit a valid Request for Exclusion prior to the Opt-Out Deadline (see FAQ 13).



If you are not sure whether you are included in the Settlement Class, call 1-888-846-0459.



THE SETTLEMENT BENEFITS

Under the Settlement, Bricker will pay $1,950,000.00 into a non-reversionary Settlement Fund that will be used to provide the following benefits:

  • Cash reimbursement for unreimbursed and documented Out-of-Pocket Losses and Extraordinary Out-of-Pocket Losses incurred and fairly traceable to the Incident (see FAQ 8);
  • Cash reimbursement for Undocumented Time and Documented Time spent related to the Incident (see FAQ 8);
  • Additional Cash Payments from monies remaining in the Settlement Fund, if any, as set forth in paragraph 13b of Addendum A to the Settlement Agreement;
  • Attorneys’ fees and expenses as approved by the Court (see FAQ 12), service awards as approved by the Court (FAQ 12), and the costs of notifying the Settlement Class and administering the Settlement.

Depending on the number of valid claims, the costs of settlement administration, and the amount awarded by the Court for attorney’s fees and costs and service award payments, payments for certain benefits may be reduced proportionally as set forth in paragraph 13a of Addendum A to the Settlement Agreement.



Settlement Benefit: Payment for Unreimbursed Out-of-Pocket Losses and Extraordinary Out-of-Pocket Losses: The Settlement provides for reimbursement of documented Out-of-Pocket Losses which mean out-of-pocket costs or expenditures that a Settlement Class Member actually incurred that are supported by Reasonable Documentation that have not otherwise been reimbursed. “Out-of-Pocket Losses” include but are not limited to things such as the purchase of identity protection services, credit monitoring services, or ID theft insurance different from the services and insurance offered by Bricker in the April 2021 notice of the Data Breach that were purchased after receipt of April 2021 notice but no later than July 31, 2021, are fairly traceable to the Data Breach, and such expenses have not already been reimbursed by a third party. The Settlement also provides for reimbursement of Extraordinary Out-of-Pocket Losses which mean out-of-pocket costs, expenditures, or other financial losses that a Settlement Class Member actually incurred that are supported by Reasonable Documentation and are for losses other than things such as the purchase of identity protection services, credit monitoring services, or ID theft insurance that have not otherwise been reimbursed. Extraordinary Out-of-Pocket Losses include, but are not limited to, funds stolen from financial accounts or funds expended by a Settlement Class Member as a result of or to remedy or address ID theft that occurred after receipt of April 2021 notice of the Data Breach but no later than September 22, 2022, are fairly traceable to the Data Security Incident, and such expenses have not already been reimbursed by a third party. If you suffered Out-of-Pocket Losses and/or Extraordinary Out-of-Pocket Losses, then you can submit a claim for reimbursement up to $5,000. YOU MUST BE ABLE TO DOCUMENT YOUR CLAIM. Examples of Reasonable Documentation include documents such as receipts, telephone records, or contemporaneous correspondence.



The settlement administrator has the sole authority to determine the validity of claims for Out-Of-Pocket Losses and Extraordinary Out-of-Pocket Losses . Only valid claims will be paid. The deadline to file a claim for Out-of-Pocket Losses and Extraordinary Out-of-Pocket Losses is December 21, 2022 (this is the last day to file online and the postmark deadline for mailed claims).



Settlement Benefit: Payment for Lost Time:



You can make a claim to recover up to 4 hours of undocumented Attested Time and up to 8 hours of Documented Time, paid out at $20 per hour.

  • Undocumented Time: If you spent time dealing with fraud or identity theft or to protect yourself from future harm that is fairly traceable to the Incident, then you may make a claim for payment for this time. All Settlement Class Members may submit a claim for reimbursement of undocumented Attested Time up to four (4) hours at $20.00 per hour (up to $80) for self-certified undocumented Attested Time. The deadline to file a claim for Attested Time is December 21, 2022.
  • Documented Time: If you spent time dealing with fraud or identity theft or to protect yourself from future harm that is fairly traceable to the Incident and can provide Reasonable Documentation of your claim, then you may make a claim for payment of up to eight (8) additional hours at $20 per hour (up to an additional $160). Reasonable Documentation includes documents such as receipts, telephone records, or contemporaneous correspondence. The Settlement Administrator has the authority to determine the validity and sufficiency of documents submitted for claims for Documented Time. Only valid claims will be paid. The deadline to file a claim for Documented Time is December 21, 2022.


HOW TO GET SETTLEMENT BENEFITS

To submit a claim for Out-of-Pocket Losses, Extraordinary Out-of-Pocket Losses, Documented Time, and/or Undocumented Time fairly traceable to the Incident, you will need to file a claim form. There are two options for filing claims:

  1. File Online: You may fill out and submit the claim form. This is the quickest way to file a claim.
  2. File by Mail: Alternatively, you may fill out the claim form attached to the postcard notice or print out a claim form from the court documents page and mail it to the address on the claim form along with supporting documentation, if any. If you lost or did not otherwise receive a claim form, you can download a hard copy of the claim form here or ask the Settlement Administrator to mail a claim form to you by calling 1-888-846-0459. Fill out your claim form and mail it (including postage as necessary – the claim form attached to the postcard notice contains prepaid postage) to: Southern Ohio Health Systems Data Breach Settlement c/o Settlement Administrator, 50 Corporate Park, Irvine CA 92606

The deadline to file a claim is December 21, 2022. This is the last day to file online and/or the postmark deadline for mailed claims.



Claims for Out-of-Pocket Losses, Extraordinary Out-of-Pocket Losses, and Documented Time must be supported by Reasonable Documentation. Examples of Reasonable Documentation include documents such as receipts, telephone records, or contemporaneous correspondence. Claims for Undocumented Time do not require any supporting documentation.



Payments will be made after the Court enters the Final Approval Order and Judgment and the Settlement becomes final. This process may take several months or longer if there is an appeal; please be patient. Checks for valid claims for Out-of-Pocket Losses, Extraordinary Out-of-Pocket Losses, Documented Time, and Undocumented Time either will be mailed by the Settlement Administrator to the mailing address that you provide, or will be provided through PayPal or Venmo at your election on your claim form.



If the Settlement Administrator determines that a claim is deficient, the Settlement Administrator will send a letter notifying the claimant of the deficiency. The claimant then has 21 days from receipt of the deficiency letter to cure the deficiency and resubmit the claim if he or she so chooses.



LEGAL RIGHTS RESOLVED THROUGH THE SETTLEMENT

If you make a claim under the Settlement, or if you do nothing, you will be releasing all of your legal claims against the Health Systems and Bricker arising out of the issues this Settlement resolves. Unless you exclude yourself from the Settlement (see FAQ 13), all of the decisions by the Court will bind you. The specific claims you are giving up against the Health Systems and Bricker are described in Section VIII of the Settlement Agreement. The Settlement Agreement is available here. You will be releasing TriHealth, Adena, Bricker and all related people and entities as described in Section VIII of the Settlement Agreement.



The Settlement Agreement describes the released claims with specific descriptions, so read it carefully. If you have any questions regarding the release, you may contact Class Counsel as provided for in FAQ 11.



THE LAWYERS REPRESENTING YOU

Yes. The Court appointed attorneys to represent you and other Settlement Class Members as “Class Counsel.” Class Counsel can be reached at:



Joseph M. Lyon
The Lyon Firm
2754 Erie Avenue
Cincinnati, Ohio 45208
Phone: (513) 381-2333
jlyon@thelyonfirm.com



Jeffrey S. Goldenberg
Goldenberg Schneider, L.P.A.
4445 Lake Forest Drive, Suite 490
Cincinnati, OH 45242
Phone: (513) 345-8291
jgoldenberg@gs-legal.com



Brian D. Flick
DannLaw
15000 Madison Avenue
Lakewood, OH 44107
(216) 373-0539
bflick@dannlaw.com


You will not be directly charged by these lawyers for their work on the case. Any fees approved by the Court to be paid to Class Counsel will be paid from the Settlement Fund. If you want to be represented by your own lawyer, you may hire one at your own expense. If you have questions about how to submit a claim or if you need to update your address information, please contact the Settlement Administrator (see FAQ 15).



Class Counsel have undertaken this case on a contingency-fee basis and have not been paid any money in relation to their work on this case to date. Accordingly, Class Counsel will ask the Court for an award of attorneys’ fees not to exceed one-third (33.33%) of the Settlement Fund, or $649,935.00. Plaintiffs will also seek approval of a Service Award for their work on the case, in an amount not to exceed $2,500 each. The Court will decide the amount of fees, costs and Service Awards to be paid. Class Counsel’s request for attorneys’ fees and costs, and Plaintiffs’ Service Awards (which must be approved by the Court) will be filed on October 7, 2022 and will be available to view on the Court Documents Page.



EXCLUDING YOURSELF FROM THE SETTLEMENT

If you are a member of the Settlement Class but do not want to remain in the class, you may exclude yourself from the class (also known as “opting out”). If you exclude yourself, you will lose any right to object to or participate in the Settlement, including any right to receive the benefits outlined in the Notice.



If you decide to exclude yourself, you may keep any rights you have, if any, against the Health Systems and Bricker and you may file your own suit against them based upon the same legal claims that are asserted in this lawsuit, but you will need to find your own attorney at your own cost to represent you in that lawsuit. If you are considering this option, you may want to consult an attorney to determine your options.



To exclude yourself from the Settlement, you must complete and mail a request for exclusion, postmarked no later than November 7, 2022, to the address below. You may also visit the Court Documents page to download a request for exclusion form.



Southern Ohio Health Systems Data Breach Settlement Administrator
Attn: Exclusion
c/o CPT GROUP INC.
50 Corporate Park, Irvine, CA 92606

This statement must contain the following information:

  1. The name of this proceeding (In Re Southern Ohio Health Systems Data Breach Litigation, Case No. A2101886 or similar identifying words);
  2. Your full name and address;
  3. The words “Request for Exclusion” or a comparable statement that you do not wish to participate in the settlement at the top of the communication; and
  4. Your signature.

If you do not comply with these procedures and the November 7, 2022 postmark deadline for exclusions, you will lose any opportunity to exclude yourself from the Settlement Class and will be bound by the settlement if it is approved by the Court and will release any and all claims against Bricker and the Health Systems as described in the Settlement Agreement.



OBJECTING OR COMMENTING ON THE SETTLEMENT

If you are a Settlement Class Member, you can object to the Settlement if you don’t think it is fair, reasonable, or adequate, including Class Counsel’s motion for an award of attorneys’ fees, costs and expenses, and Service Awards to the Settlement Class Representatives. The Court cannot order a larger settlement or award you more based on your individual circumstances; the Court can only approve or deny the Settlement as it is presented.



To object, you must send a letter to the Clerk of Court stating that you object to the Settlement. Your objection must include:

  1. The name of this proceeding (In Re Southern Ohio Health Systems Data Breach Litigation, Case No. A2101886 or similar identifying words)
  2. Your full name, address, and telephone number;
  3. State with specificity the grounds for the objection, as well as any documents supporting the objection;
  4. The name and address of any attorneys representing you with respect to the objection;
  5. A statement regarding whether you or your attorney intend to appear at the Final Approval Hearing; and
  6. You or your attorney’s signature.

To be considered by the Court, your objection must be mailed, postmarked no later than November 7, 2022 to the following address:



Clerk of Court for the Hamilton County Court of Common Pleas

1000 Main Street, Cincinnati, Ohio 45202

File all objections with the Clerk of Court. Do not submit your objections directly to the Court. If you do not comply with these procedures and the November 7, 2022 deadline for objections, you may lose any opportunity to have your objection considered at the Final Approval Hearing or otherwise to contest the approval of the Settlement or to appeal from any orders or judgments entered by the Court in connection with the proposed Settlement. You will still be eligible to receive settlement benefits if the Settlement becomes final, even if you object to the Settlement.



The Court has scheduled a Final Approval Hearing to listen to and consider whether the Settlement is fair, adequate, and reasonable. If there are objections, the Court will consider them.



The hearing will take place on November 17, 2022, at 3 pm before the Honorable Jennifer Branch, at the Court of Common Pleas for Hamilton County, Courtroom 320, 1000 Main Street, Cincinnati, Ohio 45202. This hearing date and time may be moved or may be conducted telephonically or by video conference.



GETTING MORE INFORMATION

The notice summarizes the Settlement. More details are in the Settlement Agreement itself. You can view a copy of the Settlement Agreement and other case documents here. If you have questions about this Notice or the Settlement, you may contact the Settlement Administrator by calling 1-888-846-0459, emailing to SOHSDataBreachSettlement@cptgroup.com or by mail at In Re:

Southern Ohio Health Systems Data Breach Settlement
c/o CPT GROUP INC.
50 Corporate Park, Irvine CA 92606

If you wish to communicate directly with Class Counsel, you may contact them using the information noted in FAQ 11. You may also seek advice and guidance from your own private attorney at your own expense, if you wish to do so. The status of the Settlement, any appeals, and the date of payments will be posted on the Settlement website. The Final Approval Hearing is currently scheduled for November 17, 2022, at 3 pm and will be posted on the Home Page. Please check the Home Page to see if the Court makes any changes to the date or time of the Final Approval Hearing. The Court cannot respond to any questions regarding this Notice, the lawsuit, or the proposed settlement.



Please do not contact the Court or its Clerk with questions about the Settlement.