$4.95 Million Settlement After a Healthcare Communication Service Breach
ConnectOnCall has agreed to a proposed $4.95 million settlement following a 2024
cybersecurity incident involving sensitive information shared between healthcare
providers and their patients.
ConnectOnCall is an after-hours answering
service used by healthcare providers in
the United States. According to the settlement information, an unknown threat actor
gained access to the ConnectOnCall platform between February 16 and May 12, 2024,
and was able to access and exfiltrate certain data, including provider-patient
communications.
The incident was discovered on May 12, 2024. ConnectOnCall
later began notifying
potentially affected individuals in December 2024. Information potentially involved
in the incident included names, addresses, telephone numbers, health-related
information, treatment or prescription information, and certain communications
between patients and healthcare providers.
The incident subsequently led to a
class action lawsuit against ConnectOnCall.com,
LLC and Phreesia, Inc. The lawsuit alleged, among other things, that the companies
failed to adequately protect sensitive information. The defendants have denied the
allegations and any wrongdoing or liability, and the court has not made a finding of
wrongdoing. The parties agreed to the settlement to avoid the cost, uncertainty and
risks of continuing the litigation.
Under the proposed settlement, a $4.95
million fund would be established for
eligible class members, settlement administration costs and other court-approved
expenses. Eligible individuals may receive either compensation for documented losses
of up to $5,000 or an alternative cash payment of up to $75, depending on the number
of valid claims. They can also receive two years of dark web and medical data
monitoring.
For organizations operating in healthcare, this case is another
reminder that
cybersecurity cannot stop at the main company network. Third-party platforms
handling patient communications can also become a pathway to sensitive
information.
Strong access controls, monitoring, secure data handling,
regular security
assessments and a clear incident response plan are essential when dealing with
healthcare information.
At URated CyberSecurity, we believe incidents like
this highlight the importance of
taking a proactive approach to cybersecurity, especially when sensitive customer or
patient information is involved.
The settlement is currently subject to final
court approval, with a final approval
hearing scheduled for November 17, 2026.
Healthcare
