ConnectOnCall Data Breach Settlement — File a Claim

ConnectOnCall.com, LLC operated an after-hours communication platform used by healthcare providers to receive, route, and respond to patient calls and messages when an office was closed. Patients typically interacted with the service indirectly by calling their doctor's after-hours number and sharing information about symptoms, treatment, prescriptions, or the reason for contacting the provider. Phreesia, Inc., a healthcare technology company that provides digital tools to medical practices, acquired ConnectOnCall in October 2023.

ConnectOnCall says it identified suspicious activity on May 12, 2024. Its investigation determined that an unknown actor had access to the platform from February 16 through May 12, 2024. The court-authorized summary says data was exfiltrated, meaning copied or removed without authorization, including some provider-patient communications. Reported categories varied by person and may have included names, phone numbers, dates of birth, medical-record numbers, health conditions, treatment information, prescription information, and, for a smaller subset, Social Security numbers.

Multiple lawsuits were filed and consolidated in the U.S. District Court for the Eastern District of New York as In re ConnectOnCall.com Data Breach Litigation, Case No. 2:24-cv-08790. Consolidation means related lawsuits are managed together under one lead case to avoid duplicative proceedings. The complaints allege claims arising from the incident, including negligence, breach of contract, invasion of privacy, and unjust enrichment. ConnectOnCall and Phreesia deny wrongdoing and liability. The court has not decided that either defendant violated the law.

The parties reached a proposed $4.95 million settlement. The court authorized public notice and scheduled a final approval hearing for November 17, 2026. Preliminary approval starts the notice and claims process; it does not establish that the allegations are true, that every person's information was copied, or that anyone's information was misused.

The class generally includes living U.S. residents whose private information may have been affected by the incident. Eligible class members may request two years of dark-web and medical data monitoring and choose either up to $5,000 for documented losses or an alternative cash payment of up to $75. Cash payments may be reduced proportionally if valid claims and settlement costs exhaust the available fund. Claims must be submitted by November 2, 2026.

The settlement creates a $4.95 million fund. The fund must cover valid class benefits and court-approved deductions, including settlement administration, attorneys' fees and costs, and service awards. Because all of those amounts come from the same fund, the gross settlement figure is not the amount paid directly to claimants.

Cash Payment A offers up to $5,000 for documented losses related to the incident. A claimant must attest under penalty of perjury that they communicated after hours with a healthcare provider or the provider's office between May 12, 2014 and May 12, 2024, describe the losses, and provide supporting documentation that is not self-prepared. Examples of useful proof can include receipts, bank or credit-card statements showing unreimbursed charges, or records of fraud or identity theft. The $5,000 amount is a cap, not an automatic award.

Cash Payment B is an alternative payment of up to $75. It does not require proof of documented financial loss, but the claimant must make the same after-hours communication attestation. A class member chooses this payment instead of Cash Payment A. The final amount may be lower than $75 because cash benefits are subject to proportional reduction if valid claims and other fund obligations exceed the money available.

Class members may also elect two years of CyEx Medical Shield Complete. The court-authorized summary describes dark-web monitoring, medical identity monitoring, real-time alerts, and up to $1 million in medical identity-theft insurance, subject to the service terms. Monitoring is funded from the settlement and may be selected with either cash option.

Benefits are not guaranteed by filing. The administrator must determine that a claim is complete, accurate, timely, and valid. The court must grant final approval, and any appeals must be resolved, before distribution. The official materials do not promise a specific payment date.