Judge gives preliminary approval to $5M settlement in Geisinger data breach case

WILLIAMSPORT -- A federal judge has given preliminary approval of the $5 million settlement in the federal lawsuit arising from a 2023 data breach that impacted more than 1.3 million Geisinger patients.

U.S. Middle District Judge Matthew W. Brann on Tuesday also certified membership in the class at 1,308,363 and approved the form by which they will be notified of the settlement.

Members will have the choice of participating or opting out of the settlement.

Multiple lawsuits against Geisinger and Nuance Communications Inc. were consolidated into one case known as the Geisinger Health Data Security Litigation.

The focus of the individual cases was the data breach discovered by Geisinger on Nov. 29, 2023, but patients were not notified until the following June 24.

The plaintiffs claimed they were forced to invest significant time monitoring their accounts to detect and reduce the consequences of likely identity fraud due to the delay.

Geisinger contended it delayed notifications so as not to hinder a federal investigation.

That investigation resulted in the indictment in July 2024 of Max Vance of El Cajon, Calif., a former Philadelphia resident.

He remains detained, accused of illegally obtaining information from a protected computer. Brann has granted Vance permission to represent himself at his trial.

Terms of the proposed settlement included the creation of a $5 million fund to be used to pay approved claims, administrative expenses, attorneys' fees, litigation expenses and class representative service awards.

Participating class members will have the option to select either of these two payment options:

-- Reimbursement of documented out-of-pocket losses up to $5,000 that are more likely than not attributable to the data incident.

-- A cash payment is distributed on a pro rata basis.

In addition, the class members may elect to receive a code for a one-year enrollment in a credit/medical monitoring and identity theft protection service.

Five who filed individual suits that were consolidated are each to receive $2,000 in representative service awards for their assistance in the litigation.

Geisinger and Nuance, in agreeing to the settlement, deny any wrongdoing or liability.

Nuance is a computer software technology corporation based in Massachusetts that licenses certain software and provides related professional services to Geisinger.

In connection with those related professional services, Geisinger provided Nuance with certain personally identifiable information and personal health information of its patients.

Vance, a former principal healthcare engineer with a division of Nuance, is accused of accessing Geisinger records and downloading personal information that included names, birthdates, addresses, admit and discharge or transfer codes, medical record numbers, race, genders and phone numbers.

During a February bail hearing, Assistant U.S. Attorney Kyle Moreno described Vance, 45, as a sophisticated software engineer and identity fraudster.

Moreno revealed at the bail hearing that information on Geisinger patients was found on Vance's laptop.

Vance has been filing motions complaining about the conditions at the Lycoming County Prison, contending he should be granted a temporary release so he can properly prepare for trial.

Vance, in November 2021 in Montgomery County, changed his name legally from Andre Burk, and he moved to California the following March.