Published · United States
HIPAAHigh severityEnforcement action
Jefferson County Health Department settles data breach lawsuit for $2.25 million
Jefferson County Health Department agreed to pay $2.25 million to settle a class‑action lawsuit over a data breach disclosed in 2026.
What happened
The public health agency for Jefferson County, Missouri, faced a class‑action lawsuit after a breach exposed protected health information. The department settled the case for $2.25 million. The breach stemmed from inadequate security controls and delayed breach notification. No regulatory fine was imposed, but the settlement underscores HIPAA compliance gaps. The case was reported by The HIPAA Journal on 21 October 2026.
Why it matters
Similar public health entities should review their security safeguards and breach‑notification procedures to avoid costly settlements.
Business impact
The settlement will likely strain the department’s budget and may prompt audits of other local health agencies.
Drafted automatically from the sources below. How we write summaries
Does this summary seem wrong?What to check
Conduct a full risk assessmentHigh priority
Identify and remediate vulnerabilities in systems that store protected health information.
Update breach‑notification policiesHigh priority
Ensure notifications are made within the 60‑day HIPAA deadline.
Provide staff training on PHI securityMedium priority
Include regular refresher courses on handling and protecting health data.
1 source
Discussion
No comments yet. Start the discussion.