Summit Medical Group's 464,000-Person Breach Settlement Caps All Cash at $500,000 — $1.08 a Head if Everyone Claimed — While Class Counsel Ask for $575,000

The settlement agreement defines the “Data Incident” as “the alleged unauthorized access to Defendant's computer network resulting in the acquisition of Settlement Class members' Private Information in or around September 2024–November 2024” (§ II.28) — a window of up to three months, not a single night. Its procedural history (¶¶ 3–4) is short: “In November 2024, Defendant detected unauthorized access to certain of its information technology systems. Defendant subsequently determined the Private Information of approximately 464,000 current and former patients and employees may have been impacted,” and “in March 2025, Defendant began notifying” them. The data listed on the settlement site is the medical-identity set: names, contact and demographic information, medical record numbers, provider names, dates and facilities of service, treatment and prescription information, health insurance information, “and/or Social Security numbers.” No ransomware group is named in any of the court documents or on the settlement site, and we have not seen a claim of responsibility we could verify.

Three putative class actions were filed in Knox County Circuit Court, each randomly assigned to a different judge under local practice, and consolidated by agreement. Plaintiffs — Laura Harris, Christopher Harris, Scott Campion, and Jade Brown individually and for her minor child J.B. — filed the operative amended complaint on July 9, 2025, pleading negligence, negligence per se, breach of implied contract, breach of fiduciary duty, unjust enrichment and invasion of privacy. Summit moved to dismiss everything on August 25, 2025. The parties stayed the case (order of October 1, 2025) for a full-day mediation with Bruce Friedman of JAMS on December 10, 2025, which did not produce a deal: “the Parties were unable to reach agreement on a settlement at that time,” and negotiations continued “for months.” The preliminary approval order was signed July 28, 2026; notices mailed August 17.

Two cash options and one service, all requiring a claim form. Cash Payment A — Documented Losses: up to $2,500 for out-of-pocket losses “between September 2024, and November 4, 2026” — identity-theft or fraud losses, fees for credit reports, monitoring, freezes and unfreezes, replacement IDs, postage — with receipts, bank statements or other third-party proof; “your personal certifications, declarations, or affidavits do not constitute reasonable documentation,” and nothing already reimbursed by someone else counts. Cash Payment B — Lost Time: up to three hours at $15 an hour, a maximum of $45, on an attestation describing what you did (password changes, reviewing accounts, researching the breach). Both can be claimed together. Medical Data Monitoring: two years of CyEx Medical Shield Complete — monitoring of health-insurance ID and medical-record-number exposure and unauthorized HSA spending, with $1 million of medical identity theft insurance and a fraud-resolution agent — available to every class member who asks, cash claim or not.

Then the clause (agreement § VI.a): “Settlement Class Members' claims for Cash Payments are subject to a $500,000.00 aggregate cap, which is the maximum amount Defendant will have to pay under this Agreement for all Cash Payments. This means in the event Valid Claims for Cash Payments exceed the $500,000 cap, the amount distributed for Cash Payments may be reduced pro rata accordingly.” Documented-loss claims are paid first, lost-time claims from what remains, and “any pro rata reduction will be on an equal percentage basis.” The arithmetic is unforgiving: $500,000 across 464,000 people is $1.08 each; 11,112 valid $45 claims — 2.4 percent of the class — exhaust the cap on their own before a single documented-loss claim is counted, except that documented losses come first and push lost-time claims down further. If 5 percent of the class filed the $45 claim, about $1.04 million in valid claims would compete for $500,000 and each would pay roughly $21.50. Claim rates in these settlements are usually lower than that, which is exactly why the cap may never bind — but no one will know until November 4.

The number that reads oddly next to the $500,000 cap is class counsel's fee request: “Class Counsel shall apply to the Court for an award of $575,000.00 for attorneys' fees and litigation costs. Defendant will not oppose the request” (¶ 98). That is not paid from the cap. The structure is the one we saw this week in Highlands Oncology and Jack's Family Restaurants: there is no settlement fund at all — with the difference that Summit's cash is capped. Summit pays valid claims up to the cap, pays the two years of monitoring for every enrollee, pays “all reasonable Settlement Administration Costs … separately and in addition to all other Settlement Class Member Benefits” (order ¶ 10), pays the court-approved fees by wire within 30 days of the Effective Date, and pays service awards of $2,500 to each of the five class representatives. The order says the fee and award amounts “appear reasonable” but defers the ruling to the final hearing. The settlement is expressly “not contingent on approval of the Application for Attorneys' Fees” — a lower award changes nothing for class members, since nothing they receive comes from the same pot.

Summit also agreed to “significant data-security remedial measures,” the only one named being “the use of E-5 licenses for Microsoft Office 365” — Microsoft's top licensing tier, which includes its advanced security tools — with a confidential declaration to plaintiffs' counsel on implementation and cost. Compare two settlements we covered this week: Highlands Oncology (about 113,000 patients) and Jack's Family Restaurants both pay every valid claim in full with no cap and no fund; Summit, with roughly four times Highlands' class, caps cash at half a million. HIPAA Journal's write-up of this settlement lists the opt-out deadline as October 10; the settlement website and the court's schedule (30 days before the hearing) say October 20, and we use the official date.

October 20, 2026 is both the opt-out and the objection deadline. An opt-out is a signed letter — case name and number, your name, address, phone and email, the words “Opt-Out Request” — postmarked to Summit Data Incident Settlement, ATTN: Exclusion Request, P.O. Box 25226, Santa Ana, CA 92799-9958; you can exclude only yourself. An objection must be filed with the Clerk of Court in Knox County by the same date and mailed to the administrator, class counsel and defense counsel, with nine required elements including a five-year history of every class action objection you or your lawyer have filed, with copies of the rulings, and your own signature. November 4, 2026 is the claims deadline: online at SummitMedicalDataSettlement.com, or a printed Claim Form (the PDF is on the Simpluris CDN, download code SHC5) postmarked to the Santa Ana box; the administrator also sends forms on request at (866) 675-2936 or info@SummitMedicalDataSettlement.com. November 19, 2026 at 10:00 a.m. Central is the final approval hearing. The signed July 28 order left the hearing date blank and defined every other deadline as a count of days before it — opt-out and objections 30 days before, claims 15 days before — so the November 19 date on the settlement site is what fixes October 20 and November 4.

Payment comes “if the Court grants final approval, and after any appeals are resolved,” and the settlement site asks for patience. The Effective Date is the day after the final approval order if no objection is filed; with objections it is 30 days after the order, or 30 days after the last appellate ruling if anyone appeals (agreement § II.31). Two practical notes from the documents: the settlement class is “all living individuals in the United States whose Private Information was potentially compromised in the Data Incident, including all individuals who were mailed notice” — so a notice is evidence of membership, not a condition of it; and the mailed notice carries a claim number and login ID for the online form — if you did not keep it, the administrator's phone line and email are the route to a form. Class counsel are Stranch, Jennings & Garvey (Nashville), Kopelowitz Ostrow, Mason LLP and Siri & Glimstad; Summit is defended by Bass, Berry & Sims and Baker & Hostetler.