Henderson & Walton Women’s Center has agreed to resolve a class action lawsuit arising from a 2022 data breach that exposed the personal data and protected health information (PHI) of 34,306 individuals.
Data Breach Settlement Overview
Henderson & Walton Women’s Center, a women’s healthcare provider based in Birmingham, Alabama, agreed to resolve litigation linked to a data security incident involving unauthorized access to patient information. The settlement addressed claims associated with the exposure of sensitive data and ended the litigation in Jefferson County, Alabama.
The underlying incident involved a breach in which an unauthorized third party accessed an employee email account over a defined period in February 2022.
Breach Timeline and Investigation Findings
A forensic investigation determined that an unauthorized party gained access to an employee email account from February 11, 2022 to February 14, 2022. During this access period, the third party potentially obtained information related to patients and other individuals affected by the incident.
The types of information involved in the data breach included names, birth dates, medical data, treatment data, and driver’s license or state ID numbers. The breach affected 34,306 individuals whose HIPAA-covered information was potentially exposed during the incident window identified in the investigation.
Lawsuit Allegations and Claims
A class action lawsuit Townsel v. Henderson & Walton Women’s Center, P.C. was filed by plaintiff Kim Townsel in the Circuit Court for Jefferson County, Alabama.
The complaint alleged that Henderson & Walton Women’s Center failed to properly secure and safeguard sensitive and confidential patient information. The allegations focused on cybersecurity practices, including the use of encryption and other security measures intended to protect electronic health information (ePHI).
The lawsuit asserted claims including breach of implied contract, negligence, negligence per se, unjust enrichment, and breach of fiduciary duty. Henderson & Walton Women’s Center disputed the allegations and maintained that no wrongdoing occurred. The organization agreed to resolve the litigation through settlement to avoid continued litigation costs, operational disruption, and ongoing legal proceedings. Class counsel and the plaintiff supported the settlement agreement and obtained preliminary court approval.
Settlement Terms and Class Member Compensation
Under the settlement terms, eligible class members may submit claims for compensation tied to losses associated with the data breach. Ordinary losses are eligible for reimbursement up to a maximum of $150 per class member.
Claims for extraordinary losses may be submitted for reimbursement up to a maximum of $2,500 per class member. Individuals who spent time addressing issues related to the data breach can receive refund for up to three hours of lost time, compensated at a rate of $30 per hour.
The settlement also provides access to medical and credit monitoring services for a period of three years for class members who choose to enroll.
Court Schedule and Deadlines
The court has scheduled a final fairness hearing for August 12, 2026 to review the terms of the settlement. Individuals who wish to object to or comment on the settlement must submit their responses by June 29, 2026. Requests for exclusion from the settlement must be submitted by July 13, 2026.
Image credit: New Africa, 782938652 AdobeStock / logo©HWWC
