CaptureRx has agreed to pay $4.75 million to settle a proposed class-action lawsuit related to a data breach it experienced last year, according to court documents filed Friday.
The settlement would end a lawsuit stemming from a hack at San Antonio-based NEC Networks, a prescription claims processor that does business under the name CaptureRx. The proposed settlement agreement, filed in a Texas district court, consolidates six lawsuits filed last year, according to a proposed order granting preliminary approval of the class-action settlement agreement.
The lawsuits alleged CaptureRx failed to secure and safeguard personally identifiable information and protected health information and accused the company of negligence.
CaptureRx, which sells tools to manage inventory and claims processing for prescriptions filled at pharmacies, in February 2021 discovered files containing patient names, dates of birth and prescription data from dozens of the company's provider customers had been accessed and acquired by an unauthorized user. It began notifying customers in March.
There's no evidence the information has been misused, a CaptureRx spokesperson said in an email to Modern Healthcare.
"The protection of patient information is a top priority for CaptureRx," the statement reads. "CaptureRx has further enhanced security protocols and procedures since the event."
Download Modern Healthcare’s app to stay informed when industry news breaks.
Based on CaptureRx's report to the federal government, the hack exposed data of nearly 1.7 million patients and represented the fourth-largest healthcare breach reported in 2021.
The proposed settlement agreement is preliminary and subject to a final approval hearing from the court.
Under the proposed settlement, CaptureRx will establish a settlement fund of $4.75 million. Patients residing in the U.S. and who had personal data exposed in the breach will be eligible to receive $25 from the settlement fund, regardless of whether they experienced identity theft. Patients who resided in California at the time of the breach will be eligible for an additional $75.
Those $25 and $75 figures may be increased or reduced depending on various administrative costs and how many settlement members submit claims. Along with claims, the settlement fund will also be used to pay costs related to attorneys' fees and expenses, claims administration and any "service awards" that the court awards to the representative plaintiffs who filed the six lawsuits.
The settlement class counsel will request a service award for each representative plaintiff of $2,000, according to the proposed settlement agreement.
CaptureRx as part of the settlement agreement will also develop and implement an information security program to protect the personal data that it collects from patients.
CaptureRx denies all charges of wrongdoing and liability, according to the proposed settlement agreement.
"Nonetheless, CaptureRx has concluded that further conduct of the litigation would be protracted and expensive, and that it is desirable that the litigation be fully and finally settled in the manner and upon the terms and conditions set forth in this class settlement agreement," the agreement reads.
The company, according to the agreement, has "extremely limited resources and faces insolvency if this litigation moves forward."
