People whose private information was potentially compromised in a September 2024 cyberattack involving Summit Medical Group may qualify for two years of medical-data monitoring and cash reimbursement benefits under a proposed class action settlement. The court-authorized website says claim forms must be submitted online or postmarked by November 4, 2026.
The case is Harris, et al. v. Summit Medical Group, PLLC, Case No. 2-119-25, in the Circuit Court for Knox County, Tennessee. Summit Medical Group denies that it did anything wrong. The court has not decided whether the plaintiffs or Summit Medical Group are right, and the settlement is not an admission of liability.
Key facts
- Who may be included: All living people in the United States whose private information was potentially compromised in the incident, including everyone Summit Medical Group mailed an incident notice.
- Available benefits: Two years of CyEx Medical Shield Complete, up to $2,500 for qualifying documented losses, and up to $45 for time spent responding to the incident.
- Claim deadline: November 4, 2026.
- Opt-out and objection deadline: October 20, 2026.
- Final approval hearing: November 19, 2026, at 10:00 a.m. Eastern Time.
- Current status: Proposed settlement awaiting final court approval; no payment is guaranteed.
The notice is the strongest eligibility signal The class definition is broader than only people who received a mailed notice, but the official website says receiving notice means Summit Medical Group’s records identify the recipient as a settlement class member. Anyone uncertain about inclusion should contact the settlement administrator rather than assume they qualify.
What Summit Medical Group is and why the incident matters
Summit Medical Group is an independent Tennessee medical group. Its official website says it operates more than 100 practice locations across 23 counties and provides primary care, pediatric care, family medicine, urgent care, diagnostic imaging, physical therapy, and other services. Patients also use its online portal for appointments, messages, refill requests, test results, and billing.
That healthcare relationship explains why the information described in the settlement record is sensitive. According to the court-authorized website and notice, files potentially accessed in the September 2024 incident may have contained names, contact and demographic information, medical record numbers, provider names, dates and facilities of service, treatment and prescription information, health insurance information, and Social Security numbers.
A medical record number is an identifier a healthcare provider uses to connect a patient with records in its own system. It is not necessarily the same as a Social Security number. Health Savings Account, or HSA, information concerns tax-advantaged accounts some people use for eligible healthcare expenses. The settlement’s monitoring benefit is designed around medical-identity risks involving these kinds of healthcare identifiers.
The lawsuit alleges that files containing private information were accessed during a targeted cyberattack on Summit Medical Group’s computer systems. The settlement resolves disputed claims concerning the incident without a trial. The official materials do not say the court found that Summit Medical Group violated the law, caused a particular person’s loss, or owes damages outside the settlement process.
Who may qualify for the Summit Medical settlement
The court defined the settlement class as all living individuals in the United States whose private information was potentially compromised in the data incident, including all individuals who were mailed notice of the incident by Summit Medical Group.
The official FAQ lists several exclusions. Summit Medical Group’s directors and officers, directors and officers of its subsidiaries and affiliated companies, governmental entities, the judges assigned to the action, those judges’ immediate family members, and court staff are excluded.
Receiving a mailed or emailed notice is important because it indicates the defendant’s records identified the recipient as a class member. Notice does not guarantee that a particular claim, expense, or requested payment will be approved. The settlement administrator must still review claim forms and any required documentation.
People who believe they may be included but did not receive notice should use the contact information on the court-authorized website. Class Action Pulse cannot determine membership, connect a person to Summit Medical Group’s records, or decide whether submitted proof satisfies the settlement rules.
What benefits are available
The proposed settlement provides medical-data monitoring and two cash-payment categories. The official FAQ says all settlement class members may claim medical-data monitoring and the cash options described below. The cash-payment pool is capped at $500,000, and eligible cash payments may be reduced proportionally if approved claims exceed that amount.
“Pro rata” means proportionally. If the approved cash claims are larger than the money available for those payments, each claimant may receive less than the maximum amount associated with an individual claim. A stated cap is not a promised payment.
Two years of medical-data monitoring
Settlement class members may enroll in two years of CyEx Medical Shield Complete. The official materials say the service includes $1 million in medical identity-theft insurance and monitoring for healthcare insurance identifier exposure, medical record number exposure, and unauthorized HSA spending. It also provides access to a fraud-resolution agent if suspicious activity is identified.
Medical-data monitoring is different from a general promise that all identity risks will be detected or that every loss will be covered. The governing terms of the monitoring service and insurance control. Claimants should read the official claim form and service information before enrolling.
Up to $2,500 for documented losses
Cash Payment A allows a class member to request reimbursement of up to $2,500 for actual, documented out-of-pocket losses attributed to the data incident. The expense or loss must have occurred between September 2024 and November 4, 2026.
The official FAQ gives examples that may include identity-theft or fraud losses, fees for credit reports or credit monitoring, costs to freeze or unfreeze credit, replacement-identification costs, and postage used to contact financial institutions. The list is illustrative; it does not mean every expense in one of those categories will automatically be approved.
Documentation is required. The FAQ identifies records such as receipts as the kind of evidence a claimant may submit. A claimant’s personal certification, declaration, or affidavit does not by itself qualify as reasonable documentation, although it may provide context for other proof. Expenses already reimbursed by another source cannot be claimed again.
The $2,500 figure is a reimbursement ceiling A claimant must show an actual eligible loss connected to the incident and provide supporting records. The settlement does not promise every class member $2,500, and the cash pool may require proportional reductions.
Up to $45 for lost time
Cash Payment B allows settlement class members to claim up to three hours of time spent responding to the data incident at $15 per hour, for a maximum of $45.
Examples in the official materials include changing passwords, investigating suspicious account activity, and researching the incident. Claimants must attest that the time was spent because of the incident. An attestation is a statement confirming that information is true; it is not the same documentation rule that applies to the out-of-pocket-loss category.
The official FAQ describes medical monitoring and both cash-payment options as available settlement benefits. Claimants should follow the current claim form to understand how the administrator asks them to select and support each benefit.
Cash claims share a limited pool The settlement materials cap eligible cash payments at $500,000. If approved claims exceed that amount, the cash payments may be reduced on a pro rata basis. The monitoring benefit is described separately.
How to file a claim
The court-authorized website provides an online claim form and a downloadable paper claim form. An online claim must be submitted by November 4, 2026. A mailed claim form, including supporting documentation when required, must be completed, signed, and postmarked no later than November 4, 2026.
People who received notice should keep the identifying information included with it because the online process may ask for notice credentials. Anyone who needs a paper form or has a question about the required proof may contact the settlement administrator through the official website.
Before filing, a claimant seeking documented-loss reimbursement should gather records that identify the expense, show the amount, and help connect it to the September 2024 incident. A claimant requesting lost-time compensation should be prepared to state how much time was spent and what incident-related tasks were performed.
Submitting a claim is free through the official settlement administrator. A claimant does not need to pay a filing service to use the court-authorized process. No benefit or payment is guaranteed merely because a form is submitted.
October 20 controls opting out and objecting
The deadline to opt out of the settlement is October 20, 2026. Opting out means asking to be excluded. A person who validly opts out cannot receive settlement benefits, but generally keeps the right to pursue their own lawsuit over claims released by the settlement.
The objection deadline is also October 20, 2026. Objecting means remaining in the settlement class while telling the court why the settlement should not be approved as proposed. A person cannot object after opting out because the settlement would no longer govern that person.
These choices have different procedures and legal effects. The long-form notice describes what an opt-out request or objection must contain and where it must be sent or filed. People considering exclusion or an objection should rely on the official notice and may wish to consult a lawyer about their own circumstances.
Doing nothing also has consequences. The court-authorized website says a class member who does nothing will not receive benefits. Unless that person validly opts out, the person will remain in the class and give up the right to pursue the released claims if the settlement becomes final.
The claim deadline is later than the rights deadline Claims are due November 4, but exclusion and objections are due October 20. Waiting until the claim deadline would be too late to exercise those separate rights under the current notice.
What the lawsuit alleges and what remains undecided
The plaintiffs allege that private information was accessed during the September 2024 targeted cyberattack. A class action is a lawsuit in which named plaintiffs pursue claims on behalf of a larger group with similar issues, subject to court supervision.
The named class representatives are Laura Harris, Christopher Harris, Scott Campion, J.B. through parent Jade Brown, and Jade Brown. Summit Medical Group is the defendant. The parties agreed to settle to avoid the costs, risks, disruption, and uncertainty of continued litigation.
Summit Medical Group denies wrongdoing. The court did not decide which side is right. Preliminary approval means the court authorized notice and the claims process to move forward while reserving the final decision about whether the settlement is fair, reasonable, and adequate.
The final approval hearing is scheduled for November 19, 2026, at 10:00 a.m. Eastern Time at the Circuit Court for Knox County, Tennessee. The hearing date or time may change, so class members should check the official website for updates.
If final approval is granted, distribution will not necessarily begin immediately. Appeals may be filed, and the official materials do not provide a guaranteed payment date. Benefits are distributed only after the settlement becomes final and any appeals are resolved.
Motion graphic evaluation
Class Action Pulse evaluated whether a procedural timeline or benefit comparison would materially improve this report. No interactive graphic was added. The record has only three central dates and two straightforward cash categories, while the most important caveats involve documentation, class membership, proportional reduction, and legal consequences. Accessible headings, lists, and qualified callouts preserve those distinctions more accurately than animation.
This article provides general information, not legal advice. It does not decide whether a person qualifies, whether a loss is sufficiently connected to the incident, whether documentation is adequate, or which legal option someone should choose.
Frequently asked questions
What is the Summit Medical Group settlement claim deadline?
Online claims must be submitted by November 4, 2026. Mailed claims must be postmarked by November 4, 2026, according to the court-authorized website and notice.
Who is included in the settlement?
The class includes all living people in the United States whose private information was potentially compromised in the incident, including everyone mailed an incident notice by Summit Medical Group, subject to the exclusions in the official notice.
Does every class member receive $2,500?
No. The $2,500 amount is the maximum reimbursement for qualifying documented out-of-pocket losses. Documentation is required, and approved cash payments may be reduced proportionally if they exceed the $500,000 cash-payment pool.
What is medical-data monitoring?
The settlement offers two years of CyEx Medical Shield Complete, including monitoring tied to healthcare identifiers and $1 million in medical identity-theft insurance, subject to the service’s governing terms.
Has the settlement received final approval?
No. A final approval hearing is scheduled for November 19, 2026. The court may approve, reject, or otherwise address the proposed settlement.
Does filing a claim guarantee a payment or benefit?
No. Claims must be valid and approved, the court must grant final approval, and any appeals must be resolved before distribution.