Anne Arundel Dermatology Data Breach Settlement $2.4 Million for Patient Info Security Claims

Anne Arundel Dermatology P.A. agreed to a $2.4 million settlement after a cybersecurity incident that allegedly exposed sensitive patient information. According to the notice, unauthorized access to certain company systems occurred between Feb. 14, 2025 and May 13, 2025, affecting an estimated 1.9 million current and former patients and others. For people in the United States whose personal information or protected health information was provided to, collected by, or possessed by the practice on or before Dec. 9, 2025, the settlement creates a claim process that can provide compensation—up to $5,000 for documented out-of-pocket losses like fraud-related costs, credit freeze/unfreeze expenses, or identity theft monitoring—or an alternative estimated pro rata payment of about $100 for those without documented losses. All class members also can choose three years of medical identity and credit monitoring services, including dark web scanning, medical record monitoring, and identity theft insurance. The lawsuit was filed to challenge the adequacy of the dermatology practice’s data security and to address potential harms from the breach, including claims of negligence and unauthorized disclosure of personal and health information. While the company denied the allegations, settling is significant because it provides a structured path for thousands of affected individuals to seek relief without each person pursuing separate legal action. This kind of class action is increasingly common as healthcare organizations hold extremely sensitive data and face growing public scrutiny and enforcement around cybersecurity controls, incident response, and breach notification practices. Broader implications extend beyond one clinic: similar cases often turn on whether organizations met “reasonable” security standards for protecting protected health information (PHI), which in the U.S. typically implicate the Health Insurance Portability and Accountability Act (HIPAA) Security Rule, as well as state privacy laws and contractual obligations to safeguard patient data. In the healthcare industry, these suits also highlight that monitoring services, credit protection, and fraud resolution support are becoming standard settlement components—reflecting both regulatory expectations and patient concerns following large-scale breaches.