Modernizing Medicine Data Breach Settlement — File a Claim

Modernizing Medicine, Inc., commonly known as ModMed, develops software for specialty medical practices. Its products combine electronic health records with tools used for scheduling, practice management, billing, revenue-cycle work, patient engagement, analytics, and other clinical and administrative functions. An electronic health record, or EHR, is a digital system healthcare providers use to document and manage patient information. Depending on the person and practice, that information can include identity, insurance, billing, diagnosis, treatment, prescription, and appointment records.

The official settlement materials describe a targeted cyberattack involving two ModMed servers used to help convert limited data from retiring EHR platforms to ModMed's current platform. Data conversion is the process of moving or transforming information so it can be used in a replacement system. The settlement website says certain files containing private information were accessed. The information varied by individual and may have included names, contact information, dates of birth, Social Security numbers, health-insurance information, medical record or patient account numbers, dates of service, provider and practice names, billing or diagnostic codes, prescription information, and diagnosis or treatment information. The notice does not state that every listed data type was involved for every class member.

Patricia Cavallaro-Kearins filed the proposed class action in the U.S. District Court for the Southern District of Florida. She serves as the named plaintiff and proposed class representative, meaning she brought claims for herself and sought to represent other people with similar claims. The lawsuit alleges legal claims arising from the July 2025 incident. Modernizing Medicine denies wrongdoing and liability. The court has not decided that the plaintiff's allegations are true, that ModMed violated the law, or that every notice recipient suffered financial or identity-theft harm.

The parties agreed to a proposed $2,999,750 settlement to avoid the cost, delay, disruption, risk, and uncertainty of continued litigation. A settlement is a negotiated resolution, not a ruling that either side would have won at trial. Preliminary approval allowed notice to be issued and the claims process to begin while the court considers whether the agreement is fair enough to receive final approval. The final approval hearing is scheduled for November 17, 2026 at 2:30 p.m. Eastern, but the court may change that date.

The settlement class is narrower than all ModMed customers, all patients of practices using ModMed, or everyone whose information has ever appeared in a ModMed system. It generally covers living U.S. residents who were sent notice that the July 2025 incident affected their private information, subject to exclusions in the court-authorized notice. Eligible class members may request one of two cash benefits and may also elect two years of medical data monitoring. Claims must be submitted online or postmarked by November 2, 2026. Receiving notice and filing a form do not guarantee that a claim or a particular payment will be approved.

Class members may choose one of two cash paths. The documented-loss option offers reimbursement of up to $5,000 for actual, unreimbursed out-of-pocket losses related to the incident and incurred from July 9, 2025 through November 2, 2026. The $5,000 figure is a maximum, not an automatic payment. A claimant must submit reasonable third-party documentation, and the settlement administrator will review the request under the agreement.

The official notice gives examples of potentially eligible records and expenses, including receipts, correspondence, account records, telephone records, identity-theft or fraud losses, credit-report or monitoring fees, credit-freeze costs, replacement identification, and postage used to contact financial institutions. A personal statement by itself is not sufficient documentation. Providing records does not guarantee approval; the claimed expense must satisfy the settlement's requirements and cannot already have been reimbursed from another source.

Instead of documented-loss reimbursement, a class member may request an alternative cash payment currently estimated at $75. This option does not require proof of financial loss. The final payment is not guaranteed to equal $75 and may be higher or lower depending on the number and value of valid claims, court-approved deductions, and the net settlement fund available for distribution. A class member cannot receive both cash options.

Eligible class members may also elect two years of CyEx Medical Shield Complete in addition to either cash option. The official materials describe one-bureau credit monitoring, medical identity monitoring, dark-web scanning, security-freeze assistance, identity-theft victim support, and $1 million in medical identity-theft insurance with no deductible, subject to the service terms. Monitoring is a service benefit rather than an immediate cash award.

The settlement fund must also cover amounts authorized under the agreement and approved by the court, which may include administration expenses, attorneys' fees and litigation costs, service awards, and other approved deductions. Those deductions affect the net amount available for benefits. Class Action Pulse does not predict the final alternative payment because the official materials do not establish that figure in advance.