Twin Cities Pain Clinic Settles Data Breach Litigation

Twin Cities Pain Clinic, an Edina, Minnesota-based pain management center, has settled class action litigation arising from a July 2025 data incident that exposed patients’ personal and protected health information. A cybercriminal gained access to an employee’s email account in a business email compromise attack, exposing patient information such as names, dates of birth, addresses, email addresses, phone numbers, financial account information, medical record numbers, treatment notes, provider information, health insurance information, and Social Security numbers.

The data breach was reported to the HHS’ Office for Civil Rights as affecting 3,572 patients. Multiple class action lawsuits were filed in response to the data breach, alleging the defendant was at fault. The lawsuits were consolidated into a single action – In re Twin Cities Pain Clinic Data Breach Litigation – in the District Court of Hennepin County, Minnesota.

The consolidated lawsuit asserted claims for negligence, negligence per se , breach of contract, breach of implied contract, unjust enrichment, breach of fiduciary duty, breach of confidence, and violations of the Minnesota Uniform Deceptive Trade Practice Act and Minnesota Health Records Act. Twin Cities Pain Clinic maintains there was no wrongdoing and disagrees with the claims and contentions in the lawsuit; however, a settlement has been agreed upon that is acceptable to all parties to avoid the cost, distraction, burden, risks, and disruption to business operations from protracted litigation.

Twin Cities Pain Clinic has agreed to pay attorneys’ fees and expenses, settlement administration costs, service awards to the class representatives, and cash payments to the class members. The cash payments are subject to a $385,000 cap and will be paid pro rata if that total is exceeded. Class members may choose to submit a claim for reimbursement of documented, unreimbursed losses incurred between July 9, 2025, and November 9, 2026, up to a maximum of $450 for ordinary losses, and up to $4,500 for extraordinary losses.

Alternatively, a claim may be submitted for a flat cash payment, estimated to be $55 per class member. The deadline for objection, opting out, and submitting a claim is November 9, 2026. The final fairness hearing has been scheduled for January 20, 2027.

Get The FREE HIPAA Compliance Checklist Immediate Delivery of Checklist Link To Your Email Address Please enable JavaScript in your browser to complete this form. Business Email * Name * First Last Number * Company Name * Get Free Checklist Please Enter Correct Email Address Your Privacy Respected HIPAA Journal Privacy Policy The post Twin Cities Pain Clinic Settles Data Breach Litigation appeared first on The HIPAA Journal .