A Massachusetts federal court has granted preliminary approval to a $3.5M settlement resolving class action litigation over a January 2023 breach at ZOLL Medical Corporation, the Chelmsford-based maker of resuscitation and cardiac monitoring devices. The breach affected more than one million people, and ZOLL reported the electronic protected health information of 997,097 individuals to the HHS Office for Civil Rights.
The exposed records largely belonged to people who received or were considered for the ZOLL LifeVest, a wearable cardioverter defibrillator, and included names, addresses, dates of birth, and Social Security numbers. Unauthorized network access was identified on January 28, 2023, with notifications beginning in March of that year.
Fifteen class actions were consolidated in April 2023, and the lead complaint, Smith et al. v. ZOLL Medical Corporation, alleged the company fell short of HIPAA security obligations and delayed breach notices. The settlement fund will compensate class members, with details of individual payouts and claim deadlines to be published once the court completes final approval.
The case is a reminder for medical device companies that the data trail around connected devices, including patient registration and prescribing records, carries the same privacy weight as clinical files. Manufacturers should treat wearable device programs as covered data flows, keep notification timelines tight, and assume a breach response plan built only for the product team will be tested in court.
