Photo: Geisinger
Geisinger Health and Nuance Communications have agreed to a proposed settlement of a class action lawsuit related to a patient data breach.
The breach, which occurred around Nov. 29, 2023, involved a former Nuance employee accessing the health system's records and the personal information of more than one million patients two days after their job terminated.
The Pennsylvania Court granted preliminary approval of a $5 million class action settlement on Tuesday and scheduled a final approval hearing for March 16, 2026.
Court documents indicated that more than 1.3 million individuals impacted by the breach would soon be notified to submit a claim through the March 18, 2026, deadline.
Nuance, a Microsoft-owned information technology services business, had mailed breach notices to Geisinger patients after law enforcement completed its investigation. The vendor's former employee was charged with federal crimes last year, according to the health system, which became part of Risant Health.
Protected information exposed during the 2023 incident may have included dates of birth, addresses, admit and discharge or transfer codes, medical record numbers, race and gender information, phone numbers and facility name abbreviations.
Initially, no claims or insurance information, credit card or bank account numbers, other financial information or Social Security numbers were thought to have been breached in the incident, Geisinger had said.
However, the court's document indicated that, along with full names and dates of birth, patients' SSNs, and health insurance and medical information were exposed to an unauthorized party.
Andrea Fox is senior editor of Healthcare IT News.
Email: afox@himss.org
Healthcare IT News is a HIMSS Media publication.
