Patients whose records were taken when Covenant Health lost control of three hospital networks in 2025 now have a $2M fund to draw on. A Maine state court gave preliminary approval to the class action settlement, with final approval still to be argued.
The intrusion disrupted operations at St. Joseph Hospital and St. Mary’s Health System in Maine and St. Joseph Hospital in New Hampshire. The investigation found names, addresses, birth dates, Social Security numbers, and medical information for nearly 480,000 people had been exfiltrated.
What class members can collect
The fund covers documented out-of-pocket losses up to $5,000, a pro rata cash payment currently estimated near $75 depending on claim volume, and two years of the CyEx Medical Shield Complete monitoring package. Covenant Health denied all allegations and settled to avoid the cost and uncertainty of continued litigation. It also committed to further security changes.
For compliance officers, the mechanics are a reminder that breach settlements are priced on loss documentation, not record counts. A 480,000-person exposure resolves at roughly $4 per record in cash terms – far below the statutory HIPAA ceiling, which is why OCR penalties and state attorneys general remain the sharper risk. Health systems should confirm that cyber coverage and vendor indemnities reach a comparable order of magnitude before an incident rather than after.
Where the money actually goes
Attorneys’ fees, notice and administration costs, and service awards to the class representatives all come out of the same $2M, so per-patient recovery depends heavily on claim volume. Final payments may rise or fall proportionally. Covenant Health operates across northern New England, including long-term care and home health lines that often run on thinner security budgets than acute-care hospitals.
