A rural Missouri health department will seed a $2.25 million fund for patients whose records leaked in a 2022 break-in, closing healthcare class litigation that outlasted a motion to dismiss.
Jefferson County Health Department, headquartered in Hillsboro, spotted the activity near November 15, 2022. Intruders had been inside since October 31 of that year, reaching names, birth dates, Social Security and license numbers, bank accounts, treatment records and plan details. The agency told the HHS Office for Civil Rights on January 13, 2023 that 115,940 people were caught up.
Four years from breach to settlement
A suit landed on January 27, 2023, then merged on October 2, 2023 with a later complaint to become J.D., et al. v. Jefferson County Health Center, heard in the Circuit Court of the City of St. Louis, Missouri. Those suing said they never would have booked care at the center had they known how thin its data protections were, and pressed claims for negligence, contract breach, fiduciary failings and a broken good-faith covenant.
The department admits no fault, liability or harm, and describes the deal as a way around the expense and unpredictability of trial and appeal.
Money left for patients after fees, administration and service awards for three named representatives is thin per head. People with documents can recover up to $300, counting three hours of lost time billed at $20 an hour, while those filing nothing get a flat $150. Opt-outs, objections and claims close November 16, 2026, ahead of a December 10 fairness hearing.
The takeaway for public health agencies is scale: a county office sat on a six-figure patient population and carried the same notification burden as a hospital network.
