Susan B. Allen Hospital Data Breach Settlement — File a Claim

Susan B. Allen Memorial Hospital is a not-for-profit hospital in El Dorado, Kansas. Patients use the hospital and its clinics for medical care, diagnostic services, rehabilitation, billing, and access to health records. That relationship matters because healthcare providers hold both ordinary identifying information and protected health information, including insurance, billing, and treatment details.

The hospital says it experienced a ransomware incident beginning July 2, 2025 and ending July 14, 2025. Ransomware is malicious software or access used to disrupt systems or pressure an organization for payment, often while data is copied. The hospital's investigation found that files may have included names, addresses, dates of birth, health-insurance information, medical information, and Social Security numbers, with the information varying by person. The hospital later mailed formal notices to potentially affected individuals.

Dean Dickhout, Jessica Huston, Robin Kiddoo, and Brenda Sherman filed claims as class representatives. A class representative is a named plaintiff who brings a case for themselves and seeks to represent people with similar claims. Their lawsuit alleges that private information was accessed during the incident and asserts claims arising from the hospital's handling of that information. Susan B. Allen Memorial Hospital denies wrongdoing. The District Court of Butler County, Kansas has not decided whether the plaintiffs or the hospital would win at trial.

The parties reached a proposed settlement in In Re: Susan B. Allen Data Security Litigation, Case No. BU-2025-CV-000185. The court authorized notice and a claims process, but it has not yet granted final approval. Preliminary approval means the court found the agreement sufficiently developed to notify the proposed class and schedule a fairness review; it is not a final ruling that the hospital violated the law or that every class member suffered fraud or financial loss.

The settlement class is defined as all people sent written notification of the data incident, with limited exclusions. Class members may request two years of medical identity monitoring and may claim reimbursement for documented out-of-pocket losses, time spent responding to the incident, or both, subject to a combined $100 cap. Claims must be submitted online, emailed as an electronic image, or mailed by November 12, 2026 under the official claim instructions.

Every class member may elect two years of CyEx Medical Shield Complete. The official materials describe monitoring for healthcare-insurance identification exposure, medical-record-number exposure, and unauthorized Health Savings Account spending, together with access to a fraud-resolution agent and $1 million in medical identity-theft insurance. This is a service benefit, not a guaranteed cash payment, and its coverage remains subject to the service terms.

Class members may seek reimbursement for actual, documented out-of-pocket losses caused by the data incident and incurred from July 14, 2025 through November 12, 2026. Examples in the official notice include losses from identity theft or fraud, fees for credit reports or monitoring, costs to freeze or unfreeze credit, replacement identification costs, and postage used to contact banks. The claimant must provide records such as statements or receipts. Self-prepared notes may explain other proof but are not sufficient on their own. Expenses already reimbursed by someone else cannot be claimed again.

Class members may also claim time spent responding to the incident at $25 per hour for up to four hours. Qualifying tasks may include changing passwords, investigating suspicious account activity, or researching the incident. The claim form requires a brief description of how the time was spent. The out-of-pocket-loss and time benefits share a combined $100 cap, so they are combinable but do not produce more than $100 total cash.

The monitoring benefit may be selected in addition to the cash benefits. Receiving a notice and submitting a form do not guarantee approval. The administrator may verify the claim and request more information. Cash and monitoring will be issued only if the court grants final approval and after any appeals are resolved. The official materials do not promise a specific distribution date.