Highland Health Systems Agrees to $650,000 Settlement in Data Breach Case
Highland Health Systems has settled a lawsuit for $650,000 related to a data breach that impacted 83,543 individuals. The case, Weyerman, et al. v. Highland Health Systems et al., is currently pending in the Circuit Court for Calhoun County, Alabama, with a final approval hearing scheduled for November 30, 2026. The lawsuit claims that Highland Health Systems, a nonprofit health practice specializing in mental health and developmental disabilities, was negligent in preventing the breach. The allegations include breach of implied contract and breach of fiduciary duty. As part of the settlement, Highland will not admit to any wrongdoing.
The breach was detected on July 3, 2023, when Highland noticed unusual activity on its network. Upon discovering the breach, the organization disconnected access to the network and initiated an investigation, which concluded on May 24, 2024. The investigation revealed that sensitive information, including dates of birth, Social Security numbers, payment card details, email addresses, and medical information, had been accessed by an unauthorized actor.
In response to the breach, Highland Health Systems has committed to implementing several security measures, including the use of security monitoring software, new encryption technologies, and additional safeguards to enhance overall security. The incident highlights the challenges faced by nonprofit organizations, particularly in the healthcare sector, which often operate on tight financial margins.
The financial implications of such breaches can be severe, potentially leading to clinic closures and bankruptcy, particularly for smaller practices still recovering from the impacts of the COVID-19 pandemic. The settlement amount reflects negotiations that consider financial losses and associated costs, but it does not account for the broader financial repercussions for Highland or the community it serves.
Data breaches have become increasingly sophisticated, with hackers employing advanced tactics that are difficult to detect. However, as cyber threats evolve, so too does the technology designed to combat them. Organizations like Highland are urged to adopt robust cybersecurity measures to protect against common attack vectors, such as phishing. The breach also raises questions about the obligations healthcare providers have to protect patient data and the consequences of failing to meet those responsibilities. Highland has indicated plans to adopt NIST-compliant technical safeguards, aligning with national standards for data protection.
