Millions of patients had divulged the most private information possible in the waiting areas and exam rooms of one of the biggest medical networks in Southern California. their diagnoses. their prescription drugs. their laboratory findings. their Social Security numbers. The type of data that appears in a medical file and seems to belong only to you and your physician. Regal Medical Group, a member of the Heritage Provider Network, was the target of a ransomware attack in early 2023, and all of that data, which belonged to an estimated 3.3 million people, ended up in the hands of criminals.

26 different lawsuits were filed as a result of the breach, but they were eventually combined into one case, Head et al. v. Regal Medical Group, Inc., et al. A settlement of almost $50 million was reached earlier this year. Additionally, payments have been showing up in claimants’ PayPal inboxes, Venmo balances, and Zelle accounts in recent days. The majority of people are getting $175.

The response to that figure has been a mix of resignation and regret. People have been sharing their payment confirmations on Reddit forums devoted to tracking class action settlements, along with remarks that encapsulate the unique frustration of this particular phase of data breach litigation. They received “barely enough for a week of groceries these days,” according to one person, while those who stole the data were likely earning much more by selling it. Another claimed they couldn’t even recall making the claim. Many reported receiving payments through multiple channels, including Venmo and Zelle,

Indicating that some claimants had participated in more than one aspect of the settlement structure.
It should be noted that this settlement is truly substantial. The Regal breach is one of the biggest healthcare data incidents in recent years, and nearly $50 million is a big sum. However, distributing $50 million among millions of eligible claimants results in individual payments that seem insignificant in comparison to the actual exposure. A hacked email address is not the same as medical data. It differs from a compromised loyalty card number. Prescription records, treatment histories, and diagnosis data are examples of the type of information that can be sold in bulk to brokers who handle sensitive personal profiles or used for insurance fraud or medical identity theft. This type of exposure causes real harm that can last for years in ways that are genuinely hard to measure in a court document.

What Was Taken Can’t Be Returned: Inside the Head et al v Regal Medical Group Settlement

The issue of data security in the healthcare sector is not new, and Regal Medical Group is not the first significant medical institution to experience a breach of this magnitude. Over the past few years, ransomware operators have increasingly targeted hospital systems, insurance networks, and physician groups. Attackers specifically target healthcare data due to its combination of sensitivity and value. Complete profiles of actual people with verified health histories, financial identifiers, and contact details in one location—exactly the kind of information that sells—are held by providers.

The extent of what was compromised made the Regal breach especially noteworthy. This went beyond just contact information. Along with Social Security numbers and dates of birth, the ransomware attack exposed diagnosis and treatment details, lab test results, prescription data, and health plan member IDs. The exposure was not abstract for patients managing long-term illnesses or delicate diagnoses—the kind of information that can impact employment, insurance eligibility, and interpersonal relationships. Many people believed that these records, which were extremely intimate and poignant, were kept in a private and protected area.

Reading the settlement documents and the online claimant conversations gives me the impression that most recipients believe the $175 payment falls short of justice. The nature of the loss just doesn’t fit neatly into a compensation framework, not because the litigation was handled poorly (combining 26 lawsuits into a single $49.9 million settlement is a significant legal accomplishment). The settlement recognizes that continuous monitoring is a reasonable response to long-term exposure risk and offers identity protection and credit monitoring services in addition to cash payments, as is customary for healthcare breach settlements. Another question is whether claimants actually use those services or if they offer significant protection against the particular risks brought on by exposure to health data.

As is customary, Regal Medical Group denied liability in order to reach the settlement, and no court has found any wrongdoing. In order to avoid the expense and uncertainty of ongoing litigation on both sides, the settlement was presented as a solution. That framing likely seems a little disconnected from the real experience for patients who are sitting with a $175 deposit notification and a hazy recollection of filing a claim months ago. However, the money is real, the settlement is valid, and the settlement structure permitted larger claims for those who had specific financial losses linked to the breach. However, the process for those larger amounts required documentation, which many claimants lacked or were unable to provide.

This sequence has become so familiar that it’s difficult to ignore it. A medical professional is struck. There are millions of patient records at risk. There are lawsuits. Years go by. They come to an agreement. Checks are sent out. And somewhere in all of this, the actual act of having your medical history stolen remains unaddressed, uncorrected, and mostly unnoticed by anyone who has the authority to alter how healthcare organizations safeguard the data they possess.