The $2.25 Million Jefferson County Health Center Breach Settlement Offers $150 Without Proof — but After Fees the Fund Covers At Most About 8,650 Full Payments for 115,940 People. Claim Deadline November 16, 2026.

If you got a letter from the Jefferson County Health Department in Missouri saying your information may have been exposed in late 2022, you are almost certainly in this settlement. The official FAQ says you were notified because “records show that you received notice from the Jefferson County Health Center that your personal information may have been compromised as a result of the Security Incident that occurred between October 31 and November 15, 2022.” The court's class definition is “All Missouri residents who utilized Defendant's services and whose protected health information was compromised in the breach that was discovered on or about November 15, 2022.” Judge Thomas A. McCarthy put that class at 115,940 people in his September 10, 2026 preliminary approval order.

Money only goes to people who file. You choose one of two options on the claim form: a Fixed Cash Payment of $150, for which “no documentation is required,” or Reimbursement of up to $300 for lost time and out-of-pocket expenses, which needs proof. The claim deadline is November 16, 2026, online or postmarked. Late claims “will not be paid.” If you do nothing, you get no money and still give up your right to sue over the incident.

Before you file, check which hospital your letter came from. There is also a hospital called Jefferson County Health Center in Fairfield, Iowa; its website is titled “Jefferson County Health Center | Fairfield, IA.” Much of what comes up when you search “Jefferson County Health Center breach” is about Iowa. This settlement does not cover it: the defendant is the public health department of Jefferson County, Missouri, and the class is limited to Missouri residents who used that department's services.

The $150 is a target, not a promise. The claim form calls it “A cash payment estimated to be $150.00” and explains the adjustment: “Payment amounts will be increased if the total dollar value of all valid claims totals less than 75% of the remaining balance of the Settlement Fund and decreased if the total dollar value exceeds the remaining balance of the Settlement Fund.” The settlement agreement adds that at least 75 percent, and up to 100 percent, of the net fund goes to claimants. Nothing goes back to the health department.

The fund shrinks before anyone is paid. The court allowed class counsel to ask for attorney fees of up to 35 percent, or $787,500, plus litigation costs. Counsel can also ask for $5,000 service awards for each of the three class representatives, $15,000 in total. The FAQ estimates administration costs at $150,000. By our arithmetic, that leaves at most $1,297,500 before litigation costs, which have not been disclosed. That covers about 8,650 full $150 payments, about 7.5 percent of the 115,940 class members. If more people file, every payment drops proportionally. If claims total less than $973,125 (75 percent of that net, or roughly 6,487 fixed claims), payments go up. These are our estimates, not official figures.

The reimbursement option pays up to $300 for costs such as “fraud or identity protection, professional fees, credit repair services, and/or the time incurred dealing with the privacy breach.” The costs must fall between the date of the department's breach notice and November 16, 2026, and must not have been reimbursed by anyone else. The claim form's example is a $50.00 credit-monitoring bill dated 3/17/23, with a copy of the bill attached.

Nobody is paid before final approval. The FAQ says eligible claimants will be paid “within approximately 60 calendar days after the Court finally approves the Settlement,” and that an appeal may delay payment. Under the agreement, the department funds the settlement within 45 days after final approval, and Kroll pays within 10 days of receiving the money. If the court approves the deal at the December 10, 2026 hearing and nobody appeals, the agreement’s 45 plus 10 days and the FAQ’s roughly 60 days both point to early February, by our arithmetic; a later approval order or an appeal would push that back. You can pick Zelle, Venmo, PayPal, ACH, an E-Mastercard or a paper check. Uncashed payments go to the Missouri State Treasurer's Unclaimed Property division in your name. Any leftover money, up to 25 percent of the net fund, goes in equal shares to Compass Health Network, PreventEd and Chestnut Health Systems.

To claim: file online at JeffersonCountyBreachSettlement.com, or mail the paper form postmarked by November 16, 2026 to Settlement Administrator - 83479, c/o Kroll Settlement Administration LLC, P.O. Box 225391, New York NY 10150-5391. The claim form says filing online is the easiest way to set up an electronic payment. If you choose reimbursement, attach the documents and describe each one on the form.

Is it worth suing over a data breach? In this case, you have to decide that by November 16, 2026. Staying in gets you $150 or up to $300 (subject to proration), and you give up all claims over the incident. Opting out keeps your right to sue on your own, but the FAQ warns that “you’ll have to hire and pay your own lawyer for that lawsuit, and you’ll have to prove your claims.” The defendant would also fight back: in the agreement, the department “argues that as a political subdivision of the State of Missouri it enjoys sovereign immunity from liability.” An opt-out must be a signed letter with your name, address and phone number. It must include the sentence “I elect to exclude myself from the certified class in J.D. and F.M. v. Jefferson County Health Center d/b/a Jefferson County Health Department,” and be mailed to Kroll postmarked by November 16, 2026. You cannot opt out by phone or email. If you send both a claim and an opt-out, the FAQ says “your claim form will be disregarded.”

To object, for example to the fee request, you must stay in the class and file a written objection with the Clerk of the Circuit Court of the City of St. Louis, 10 North Tucker Boulevard, St. Louis, Missouri 63101, by November 16, 2026. You must mail copies to class counsel, defense counsel and Kroll, and appear at the hearing in person or through a lawyer. The hearing is on December 10, 2026 at 9:00 a.m. in Division 17. The court can move it without further notice. Class counsel must file the fee request 14 days before the hearing. As of October 19, 2026, it is not posted on the settlement site.

The site is real. It is court-authorized and run by Kroll, which the court appointed as administrator. It says it is “the only authorized website for this case.” The settlement documents posted there match the court's order: the $2.25 million fund, the 115,940-person class, the November 16, 2026 deadline and the December 10, 2026 hearing. Claims go only through the official site or Kroll's P.O. Box.

One thing to watch: the official materials list two different toll-free numbers. The FAQ and the long-form notice give (833) 453-3461. The site footer and the claim form give (833) 453-4461. We could not tell which one is current. To avoid the issue, use the “Contact Us” form on the official site, or write to the P.O. Box above, and keep your Class Member ID from the notice at hand. The FAQ asks you not to contact the court clerk, the judge, the department or its lawyers about the settlement.

How can I check if I have been data breached? For this incident, the test is simple: you are in the class if the department sent you a breach notice. The agreement says class members were identified on a list the department attached as an exhibit, and the settlement notices went to people on that list. If you think you were a patient during that period but got no notice, ask Kroll through the official contact form. This settlement cannot tell you whether you were caught up in a different breach, such as one at the Fairfield, Iowa hospital or another health system. For those, the letter from that organization is your starting point.

According to the settlement agreement, the plaintiffs were patients who say their “sensitive health, personal, and financial information” was “compromised, accessed, and disclosed to one or more bad actors.” They allege negligence, breach of contract, breach of confidence, breach of the implied covenant of good faith and fair dealing, and breach of fiduciary duty. The department denies wrongdoing, and the court has not ruled on the merits. The official documents do not list exactly which data fields were exposed.

The case took almost four years. The first petition was filed on January 27, 2023 in Jefferson County Circuit Court, and a second suit was consolidated into it on October 2, 2023. The court denied the department's motion to dismiss on June 28, 2023 and certified a class on May 27, 2025, before any settlement. In October 2025 the department moved to change the judge and the venue. On March 3, 2026 the court moved the case to the City of St. Louis, where it carries Case No. 2622-CC00457. The parties then negotiated “on their own without the assistance of a mediator” and signed the agreement on August 27, 2026. The agreement notes that notice of the 2025 certification had not been sent to the class, and that it would go out as part of the settlement process.

Two features shape the outcome. The documented-loss option is capped at $300, only twice the no-proof amount. And because the fund is fixed, the actual payment depends mostly on how many of the 115,940 people file by November 16, 2026. The next public step is the fee request, due 14 days before the December 10, 2026 hearing.