Family Medicine Centers in Texas has agreed to a $2,150,000 settlement to resolve claims from a July 2022 data breach affecting 233,948 patients. Unauthorized actors accessed systems containing PII and protected health information (PHI), including Social Security numbers and health records. The consolidated lawsuit alleged inadequate security measures, with claims spanning negligence, breach of fiduciary duty, and unjust enrichment. The settlement provides up to $5,000 per class member for documented losses or an estimated $75 alternative payment, plus two years of medical data monitoring.

Healthcare remains one of the most targeted and costly sectors for breach litigation. PHI commands a premium on dark web markets because it cannot be reissued like a credit card, and HIPAA treats its exposure with particular severity. For smaller providers, the financial exposure is disproportionate: a breach affecting a few hundred thousand patients can generate multi-million-dollar settlements, OCR enforcement, and lasting reputational damage. Compounding the problem, healthcare networks run a mix of EHRs, imaging platforms, patient portals, and connected devices — each with its own logging and network footprint — making intrusions hard to detect in time to limit scope.

Reducing exposure requires unified visibility across endpoints, identity systems, network flows, and packet-level data, paired with encryption and HIPAA-aligned access controls. Effective controls include behavioral analytics on clinical system access, baselining of data movement between EHRs and downstream applications, and full packet capture with long retention for forensic reconstruction. Unified platforms like NIKSUN — which consolidate packets, flows, logs, events, and threat intelligence into a single data lake with AI-driven analytics and forensics — give healthcare security teams the context needed to detect unauthorized PHI access in progress and produce the evidence regulators and plaintiffs demand. Read more about this story on our LinkedIn page