Two years after an October 2024 intrusion, Washington Gastroenterology has accepted a mediator’s proposal to close the consolidated class action it faced. The practice will stand up a $4,600,000 fund covering 583,741 people whose names, Social Security numbers, banking details, clinical records, and insurance information were exposed. The breach was detected January 28, 2025; patients were not told until August 22, 2025, roughly sixteen months after the attackers arrived.
Litigation consolidated in Pierce County Superior Court, combining negligence, unjust enrichment, invasion of privacy, and state consumer protection and health-information claims. The practice denies wrongdoing. Preliminary approval is in hand and a final fairness hearing is set for January 29, 2027.
What class members actually get
Two years of single-bureau medical record and credit monitoring is open to everyone in the class. Beyond that, claimants pick one of two paths: documented out-of-pocket loss reimbursement capped at $4,000 each, or a pro rata cash payment estimated at $75. That estimate moves with claim volume, and it is the number to watch – a $75 ceiling rarely feels like compensation for a Social Security number.
Why the delay is the story
Sixteen months between detection and patient notice is well past the HIPAA outside limit of 60 days from discovery, and the settlement papers do not explain it. Regulators now treat notification lag as its own violation rather than a footnote to the underlying breach. Practices that sit on forensic findings while counsel debates wording risk a separate enforcement exposure.
Practical takeaway
Run tabletop exercises that force a notification date, not just an incident timeline. Preserve the forensic scope memo early so you can identify affected records without reopening the investigation. And price notification and credit monitoring into your cyber policy – the $4.6M here is mostly class benefits and administration.
