Balance Autism has agreed to settle a class action lawsuit stemming from a security incident that exposed patient information. Altoona, Iowa-based Balance Autism identified a cybersecurity incident on or around March 17, 2025, that resulted in a data breach. Hackers had access to its network from March 11, 2025, to March 17, 2025, and obtained access to data such as names, dates of birth, Social Security numbers, health insurance information, and Medicaid numbers. The data breach was reported to the HHS’ Office for Civil Rights as involving unauthorized access to the protected health information of 1,281 individuals.
A class action lawsuit – Bennett v. Balance Autism – was filed in the Iowa District Court for Polk County by plaintiff Andrea Bennett, individually and on behalf of other similarly affected individuals. The lawsuit alleged that the cybersecurity incident resulted from the defendant’s negligence in failing to implement reasonable and appropriate cybersecurity measures to protect sensitive data on its network. The lawsuit asserted claims for negligence, breach of implied contract, unjust enrichment, breach of fiduciary duty, and invasion of privacy. The defendant denies all claims and contentions in the lawsuit, including allegations of fault, wrongdoing, and liability; however, following mediation, a settlement was agreed that was acceptable to all parties to bring the litigation to an end.
Under the terms of the settlement, Balance Autism has agreed to pay for two years of credit monitoring and identity theft protection services and will accept claims from the affected individuals for up to $400 as reimbursement for out-of-pocket losses due to the data breach, and up to four hours of lost time at $20 per hour. Alternatively, instead of submitting a claim for reimbursement of losses and lost time, class members may submit a claim for a cash payment, which is estimated to be $50, but may be lower, depending on the number of claims received…